# How to remove subfield using pattern

**URL:** https://discuss.elastic.co/t/how-to-remove-subfield-using-pattern/145101
**Category:** Logstash
**Created:** [August 20, 2018, 7:10am UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-pattern/145101 "2018-08-20T07:10:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jerry-chen-315](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry-chen-315/32/34699_2.png) [@jerry-chen-315](https://discuss.elastic.co/u/jerry-chen-315)
#### Post date: [August 20, 2018, 7:10am UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-pattern/145101/1 "2018-08-20T07:10:55Z")

</div>

logstash version 6.2.1

my message like this:

> {"@timestamp":"2018-08-12T15:53:02Z","hostanme":"server-oem","hostip":"162.12.1.240","tag":"auditlog","event\_id":521244,"EXECVE":{ "type": "EXECVE", "argc": "28", "a0": ""find"", "a1": ""/var/log/sa/"", "a2": ""("", "a3": ""-name"", "a4": ""sar??"", "a5": ""-o"", "a6": ""-name"", "a7": ""sa??"", "a8": ""-o"", "a9": ""-name"", "a10": ""sar??.gz"", "a11": ""-o"", "a12": ""-name"", "a13": ""sa??.gz"", "a14": ""-o"", "a15": ""-name"", "a16": ""sar??.bz2"", "a17": ""-o"", "a18": ""-name"", "a19": ""sa??.bz2"", "a20": "")"", "a21": ""-mtime"", "a22": ""+7"", "a23": ""-exec"", "a24": ""rm"", "a25": ""-f"", "a26": ""{}"", "a27": "";"" }}`

my filter like this:

```
filter {
ruby {
code => "event['EXECVE'].keys.each { |k|
event['EXECVE'].remove(k) if k.start_with?('a')
}
"
}
}

```

But no field removed.

If i wanna remove some fields like a10,a11,a12... aNN,Can i use regex with "start\_with" and how?

---

<div class="post-metadata">

### Author: ![jerry-chen-315](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jerry-chen-315/32/34699_2.png) [@jerry-chen-315](https://discuss.elastic.co/u/jerry-chen-315)
#### Post date: [August 27, 2018, 1:32am UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-pattern/145101/2 "2018-08-27T01:32:40Z")

</div>

anything is appreciate

---

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [August 31, 2018, 7:15pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-pattern/145101/3 "2018-08-31T19:15:44Z")

</div>

Every filter supports the common option, `remove_field`...so something like:

```
filter {
  mutate {
    id => "Field Removal"
    remove_field => [
      "[execve][a10]",
      "[execve][a11]",
      "[execve][a12]"
    ] 
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2018, 7:15pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-pattern/145101/4 "2018-09-28T19:15:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.