# How to remove IP-address from elasticsearch submission after geoip parses it?

**URL:** <https://discuss.elastic.co/t/how-to-remove-ip-address-from-elasticsearch-submission-after-geoip-parses-it/90504>\
**Category:** Logstash\
**Created:** [June 22, 2017, 5:33pm UTC](https://discuss.elastic.co/t/how-to-remove-ip-address-from-elasticsearch-submission-after-geoip-parses-it/90504 "2017-06-22T17:33:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![UnitedMarsupials](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/unitedmarsupials/32/19429_2.png) [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\
**Post date:** [June 22, 2017, 5:33pm UTC](https://discuss.elastic.co/t/how-to-remove-ip-address-from-elasticsearch-submission-after-geoip-parses-it/90504/1 "2017-06-22T17:33:35Z")

</div>

Our logs contain clients' IP-addresses, which we pass to the `geoip`-filter:

```
filter {
		geoip {
			source => "client_ip"
		}
...
output {
		elasticsearch {
			hosts => ["...."]
			index => "logstash-%{+YYYY.MM.dd}"
		}
...

```

This sends _both_ -- the original `client_ip` field (found by a `match`) and the geographical information derived from it -- into ElasticSearch. However, we do not want to keep the IP-address around -- to save space and avoid tangling with Europe's "privacy" regulations. How do we exclude it?

---

<div class="post-metadata">

**Author:** ![Rory](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@Rory](https://discuss.elastic.co/u/Rory)\
**Post date:** [June 22, 2017, 8:35pm UTC](https://discuss.elastic.co/t/how-to-remove-ip-address-from-elasticsearch-submission-after-geoip-parses-it/90504/2 "2017-06-22T20:35:39Z")

</div>

Check out Mutate Filter remove\_field: [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 22, 2017, 11:36pm UTC](https://discuss.elastic.co/t/how-to-remove-ip-address-from-elasticsearch-submission-after-geoip-parses-it/90504/3 "2017-06-22T23:36:09Z")

</div>

You can also remove it in the geoip filter . [https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-remove\_field](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-remove_field)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 11:36pm UTC](https://discuss.elastic.co/t/how-to-remove-ip-address-from-elasticsearch-submission-after-geoip-parses-it/90504/4 "2017-07-20T23:36:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.