# How to whitelist a hunreds nested field
**URL:** https://discuss.elastic.co/t/how-to-whitelist-a-hunreds-nested-field/342563
**Category:** Logstash
**Created:** [September 8, 2023, 3:24am UTC](https://discuss.elastic.co/t/how-to-whitelist-a-hunreds-nested-field/342563 "2023-09-08T03:24:10Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@yuswanul](https://discuss.elastic.co/u/yuswanul)
#### Post date: [September 8, 2023, 3:24am UTC](https://discuss.elastic.co/t/how-to-whitelist-a-hunreds-nested-field/342563/1 "2023-09-08T03:24:10Z")
I plan to whitelist around 600 fields from 3000 fields in my index pattern but how do I do it?
if I use `mutate rename` and then use `mutate remove` to delete the rest of it. it will put so much work into it. I wonder if there is a way to list the fields inside a file and use a ruby filter to check it and remove all fields except the fields inside the file.
but the question is, is it possible? or is there an efficient way to achieve it?
Thanks
---
### Author:  [@yuswanul](https://discuss.elastic.co/u/yuswanul)
#### Post date: [September 11, 2023, 10:36am UTC](https://discuss.elastic.co/t/how-to-whitelist-a-hunreds-nested-field/342563/2 "2023-09-11T10:36:04Z")
this is my sample data
```auto
{"response_string":"200","tries":{"port":"980","ip":"10.10.10.1","code":"kuli","state":"lelah"},"request":{"url":"http://wakwaw.com?ciwawaw","headers":{"accept":"accepted","x-tray":"xxxyyyzzz","consumer":"ichigo","mashery-header":"crabs","forwarded-port":"thousand-year_blood-war","api_key":"hcsduchsuiueq"},"querystring":{"type":"string","url":"xxx","channel":"001","message":"wkwkwkwk","api_key":"qowqidopiqw"}},"response":{"headers":{"accept":"Confirmed","cache":"exist","access":"granted"}},"kubernetes":{"host":"asoe","namespace":"jancuk","labels":{"app":"ortodox","deploy":"cloud"}}}
```
how if I want to whitelist
- request.headers.accept
- request.headers.api\_key
- request.querystring.channel
- request.querystring.type
- response.headers.access
- all fields under kubernetes
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 9, 2023, 10:36am UTC](https://discuss.elastic.co/t/how-to-whitelist-a-hunreds-nested-field/342563/3 "2023-10-09T10:36:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.