# How to remove any field matching a string

**URL:** https://discuss.elastic.co/t/how-to-remove-any-field-matching-a-string/45359
**Category:** Logstash
**Created:** [March 24, 2016, 3:01pm UTC](https://discuss.elastic.co/t/how-to-remove-any-field-matching-a-string/45359 "2016-03-24T15:01:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)
#### Post date: [March 24, 2016, 3:01pm UTC](https://discuss.elastic.co/t/how-to-remove-any-field-matching-a-string/45359/1 "2016-03-24T15:01:15Z")

</div>

I have found the ruby fix for deleting events if they are 'nil', but I am wondering if there is a clean/easy way to delete any event if it matches one of a few strings.

Essentially, I have some integer fields coming in. But if the system sending the JSON doesn't get an integer value, it can either pass a "-" or "(empty)".

Fields with these values are of no use to me. So I would like to simply refrain from sending them to Elastic.

What would be the best practice for this?

And as a second part, what would happen if I used the `mutate convert` to cast these to integers? What will happen if I try to cast a non-integer based value to an integer?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 24, 2016, 5:02pm UTC](https://discuss.elastic.co/t/how-to-remove-any-field-matching-a-string/45359/2 "2016-03-24T17:02:30Z")

</div>

> Essentially, I have some integer fields coming in. But if the system sending the JSON doesn't get an integer value, it can either pass a "-" or "(empty)".

> Fields with these values are of no use to me. So I would like to simply refrain from sending them to Elastic.

Have a look at the prune filter.

> And as a second part, what would happen if I used the `mutate convert` to cast these to integers?

By the look of the code you'd get an exception in the log. It should still let the message through, I think. If that causes the event to be dropped I'd say it's a bug. It would be easy to try, of course.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/how-to-remove-any-field-matching-a-string/45359/3 "2017-07-06T05:05:30Z")

</div>


