# How to drop field in message

**URL:** <https://discuss.elastic.co/t/how-to-drop-field-in-message/144689>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 16, 2018, 10:35am UTC](https://discuss.elastic.co/t/how-to-drop-field-in-message/144689 "2018-08-16T10:35:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nxdu93](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nxdu93/32/34308_2.png) [@nxdu93](https://discuss.elastic.co/u/nxdu93)\
**Post date:** [August 16, 2018, 10:35am UTC](https://discuss.elastic.co/t/how-to-drop-field-in-message/144689/1 "2018-08-16T10:35:26Z")

</div>

Hi all !

processors:

- drop\_fields:  
fields: ["\_source.message.index", "\_source.message.layers", "\_source.message.frame", "\_source.message.eth", "fields", "tags"]

I want to delete the fields not required in message as: "\_source.message.index", "\_source.message.layers", "\_source.message.frame", "\_source.message.eth", "fields", "tags"

**Message content**

_ **t** _ message {"timestamp" : "1534413881819", "layers" : {"frame": {"frame\_frame\_interface\_id": "0","frame\_interface\_id\_frame\_interface\_name": "eno2","frame\_frame\_encap\_type": "1","frame\_frame\_time": "Aug 16, 2018 17:04:41.819181684 +07","frame\_frame\_offset\_shift": "0.000000000","frame\_frame\_time\_epoch": "1534413881.819181684","frame\_frame\_time\_delta": "0.001338664","frame\_frame\_time\_delta\_displayed": "0.001338664","frame\_frame\_time\_relative": "7.695004114","frame\_frame\_number": "9316","frame\_frame\_len": "625","frame\_frame\_cap\_len": "625","frame\_frame\_marked": "0","frame\_frame\_ignored": "0","frame\_frame\_protocols":

Thanks all !

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 16, 2018, 1:42pm UTC](https://discuss.elastic.co/t/how-to-drop-field-in-message/144689/2 "2018-08-16T13:42:04Z")

</div>

Could you please format the processor configuration using `</>`?  
Also, what is exactly the problem with this config?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2018, 1:42pm UTC](https://discuss.elastic.co/t/how-to-drop-field-in-message/144689/3 "2018-09-13T13:42:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.