# How to get rid of event.original field? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 29, 2022, 1:14pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604 "2022-04-29T13:14:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![alytkowski](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Post date:** [April 29, 2022, 1:14pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/1 "2022-04-29T13:14:54Z")
After upgrading to ELK 8.1, I noticed that every event has the "event.original" field containing all of the log data. This is highly unwanted, how to prevent this field from being sent from Filebeat? I tried doing it on Filebeat level using processors: ```auto processors: - drop_fields: fields: ["event.original"] ``` and via Logstash remove\_field. None of this worked, the field is still visible. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 29, 2022, 1:33pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/2 "2022-04-29T13:33:31Z")
Are you using any filebeat module? The field `event.original` is normally created by the ingest pipeline used by some of the filebeat modules when parsing the original message, it does not exist in your original event, so you won't be able to remove it in filebeat nor in logstash, you would need to check the ingest pipeline for the module that you are using and remove the field there. ---
**Author:** ![alytkowski](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Post date:** [April 29, 2022, 2:39pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/3 "2022-04-29T14:39:58Z")
My whole filebeat config is as below: ```auto filebeat.inputs: - type: filestream enabled: true paths: - /path/to/IOB.log parsers: - multiline: type: pattern pattern: '^\[[0-9]{2}-[0-9]{2}-[0-9]{2}[[:space:]]+[0-9]{2}:[0-9]{2}:[0-9]{2}' negate: True match: after name: iob1_int tags: ["iobint1-logs"] ignore_older: 24h - type: filestream enabled: true paths: - /path/to/server.log parsers: - multiline: type: pattern pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}[[:space:]]+[0-9]{2}:[0-9]{2}:[0-9]{2}' negate: True match: after name: iob1_int tags: ["iobint1-logs_server"] ignore_older: 24h processors: - drop_fields: fields: ["event.original","agent.type"] output.logstash: hosts: ["hostname:5044"] ssl.certificate_authorities: - /path/to/ca.crt monitoring: enabled: true cluster_uuid: 123456789 elasticsearch: hosts: ["https://hostname:9200"] ssl.certificate_authorities: ["path/to/crt"] username: XXX password: XXX ``` After filebeat, Logstash parses the logs and sends to Elastic. Do you mean that the field is added on Logstash level? How to delete it? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 29, 2022, 2:49pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/4 "2022-04-29T14:49:11Z")
What is your logstash pipeline? Please share it. Logstash normally won't add any field unless explicitly configured in the pipeline, but I'm not running version 8.X and there was some changes regarding the ecs fields, so I'm not sure if this is being added by logstash or not. How you tried to remove it in Logstash? Did you have something like this? ```auto mutate { remove_field => ["[event][original]"] } ``` ---
**Author:** ![alytkowski](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Post date:** [April 29, 2022, 2:59pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/5 "2022-04-29T14:59:10Z")
Thank you! I tried to delete the field like below: remove\_field =\> ["event.original"] and this didn't work. This solves the issue for me. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 29, 2022, 3:02pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/6 "2022-04-29T15:02:17Z")
Ah yes, this is confusing some times. In filebeat and Elasticsearch you work with nested fields using `top.nested`, like `event.original`, but in logstash you need to use `[top][nested]`, so it should be `[event][original]`. Using `event.original` in Logstash would make it try to work with a field with that literal name, with the dot in the name. ---
**Author:** ![alytkowski](https://avatars.discourse-cdn.com/v4/letter/a/cc9497/32.png) [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Post date:** [April 29, 2022, 3:03pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/7 "2022-04-29T15:03:26Z")
Thank you for a very fast response on a Friday afternoon! Much appreciated! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 27, 2022, 5:04pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-event-original-field/303604/8 "2022-05-27T17:04:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.