# How to disable logstash add default field automatically?

**URL:** <https://discuss.elastic.co/t/how-to-disable-logstash-add-default-field-automatically/360695>\
**Category:** Logstash\
**Created:** [June 3, 2024, 8:14am UTC](https://discuss.elastic.co/t/how-to-disable-logstash-add-default-field-automatically/360695 "2024-06-03T08:14:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Victor\_Lee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/victor_lee/32/124452_2.png) [@Victor\_Lee](https://discuss.elastic.co/u/Victor_Lee)\
**Post date:** [June 3, 2024, 8:14am UTC](https://discuss.elastic.co/t/how-to-disable-logstash-add-default-field-automatically/360695/1 "2024-06-03T08:14:53Z")

</div>

I am using Logstash and Elasticsearch as my backup database. Recently, I discovered an error related to Logstash using the JSON codec to decode my input file JSON. If the JSON does not contain a 'host' field, Logstash automatically inserts the 'host' field. However, some data in my JSON already contains a 'host' field, resulting in different data types for the 'host' field across different documents. This causes errors when Elasticsearch tries to create the template. How can I disable Logstash from automatically adding this field?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 3, 2024, 8:49am UTC](https://discuss.elastic.co/t/how-to-disable-logstash-add-default-field-automatically/360695/2 "2024-06-03T08:49:22Z")

</div>

Welcome to the community!

1. You can disable ECS on the input level or pipeline ( `pipeline.ecs_compatibility: disabled` ) . I assume that you are using [the elasticsearch plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html#plugins-inputs-elasticsearch-ecs_compatibility).

```auto
input {
  elasticsearch {
        hosts => "localhost"
        query => '{ "query": { "match": { "statuscode": 200 } }, "sort": ["_doc"] }'
        ecs_compatibility => "disabled"
      }
}

```

1. Another option is to remove/update the field manually:

```auto
if [host][name]=="logstashhostname" {
mutate { remove_field => ["host"] } 

# or update to empty string ""
 mutate { update => { "[host][name]" => "" } }
}

```