# How to remove element value in array field
**URL:** https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006
**Category:** Logstash
**Created:** [March 1, 2018, 9:17am UTC](https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006 "2018-03-01T09:17:05Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Eswar\_Kumar\_Musiboin](https://discuss.elastic.co/u/Eswar_Kumar_Musiboin)
#### Post date: [March 1, 2018, 9:17am UTC](https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006/1 "2018-03-01T09:17:05Z")
hi,
i want to remove an element from tags array in logstash .
logstash conf:
```
filter {
kv{
source => "message"
field_split => ","
}
date {
match => ["joiningdate", "MMMM dd yyyy HH:mm:ss.SSS", "yyyy-mm-dd", "yyyy.mm.dd"]
}
if "_dateparsefailure" in [tags] {
mutate {
add_field => { "JoiningDate" => "%{joiningdate}"}
remove_field => ["joiningdate"]
}
}
}
```
message : joiningdate=1234, name=asdf
output:
{
"host" =\> "xyz",
"JoiningDate" =\> "1234",
" name" =\> "asdf\r",
"message" =\> "joiningdate=1234, name=asdf\r",
"@version" =\> "1",
"@timestamp" =\> 2018-03-01T08:32:54.572Z,
"tags" =\> [
[0] "\_dateparsefailure",
[1] "beats\_input\_code\_plain\_applied"
]
}
dateparsefailure can be in any index of tags array that should be removed.
tried tag\_on\_failure in date filter but in my logstash conf i am adding new field based on date parse failure. so pls suggest to remove \_dateparsefailure from tags array dynamically
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [March 1, 2018, 9:24am UTC](https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006/2 "2018-03-01T09:24:57Z")
you can add a remove\_tag =\> ["\_dateparsefailure"] to your mutate filter.
---
### Author:  [@Eswar\_Kumar\_Musiboin](https://discuss.elastic.co/u/Eswar_Kumar_Musiboin)
#### Post date: [March 1, 2018, 9:38am UTC](https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006/3 "2018-03-01T09:38:24Z")
Worked with
mutate {
remove\_tag =\> ["\_dateparsefailure"]
}
Thank you @pjanzen. But in my output i am getting empty tags field:
{
"@timestamp" =\> 2018-03-01T09:36:15.710Z,
" name" =\> "dhre\r",
"host" =\> "xyz",
"tags" =\> [],
"message" =\> "joiningdate=2q34, name=dhre\r",
"JoiningDate" =\> "2q34",
"@version" =\> "1"
}
here i want to remove empty array "tags". I tried
```
if [tags] == [] {
mutate {
remove_field => ["tags"]
}
}
```
But got error :
[2018-03-01T15:07:56,000][FATAL][logstash.runner] The given configuration is invalid. Reason: Failed to parse right-hand side of conditional [str]pipeline:31:8:```
[tags] == []
```auto
```
---
### Author:  [@Eswar\_Kumar\_Musiboin](https://discuss.elastic.co/u/Eswar_Kumar_Musiboin)
#### Post date: [March 1, 2018, 2:30pm UTC](https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006/5 "2018-03-01T14:30:19Z")
found solution.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2018, 2:34pm UTC](https://discuss.elastic.co/t/how-to-remove-element-value-in-array-field/122006/6 "2018-03-29T14:34:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.