# How to get rid of new field?

**URL:** <https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494>\
**Category:** Logstash\
**Created:** [April 15, 2016, 11:30am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494 "2016-04-15T11:30:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [April 15, 2016, 11:30am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/1 "2016-04-15T11:30:31Z")

</div>

Hi,  
I have created eventLogTime field in logstash indexer and assign timestamp form the log. I have provided list of timestamp while doing this. Now the problem is when we are adding applications in centralized logging, some systems have timestamps which are not in the list provided in indexer.  
Then it gives error (grokeparsefailure). Due to this I have decided to remove this filter, as its of less importance.

After commenting out this filer, I can still see eventLogTime field for new logs on Kibana?  
I hope it should not be there for new logs.

br,  
Sunil

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 16, 2016, 8:31pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/2 "2016-04-16T20:31:24Z")

</div>

Use mutate + remove\_field - [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-remove\_field](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-remove_field)

---

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [April 19, 2016, 6:38am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/3 "2016-04-19T06:38:12Z")

</div>

Hi,  
But I think this will work for current documents which are getting stored.  
It saying evenLogTIme is conflicting across indexes. How to solve this? How to get those indexes in which eventLogTime field has conflicting data type?

br,  
Sunil

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 19, 2016, 7:21am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/4 "2016-04-19T07:21:09Z")

</div>

> [@sunilmchaudhari](#):
>
> But I think this will work for current documents which are getting stored.

No, you need to reindex.

---

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [April 19, 2016, 7:43am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/5 "2016-04-19T07:43:38Z")

</div>

Hi,

Re-indexing after remove field?  
Re-indexing for new as well as old indexes? or only old indexes?  
Any guideline/documentation?

br,  
Sunil

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 19, 2016, 8:11am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/6 "2016-04-19T08:11:35Z")

</div>

If there are old documents that need changing, they need to be reindexed.  
New ones just need the new mutate applied.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/how-to-get-rid-of-new-field/47494/7 "2017-07-06T05:01:41Z")

</div>


