# Is that possible to choose the informations to index in ElasticSearch?

**URL:** https://discuss.elastic.co/t/is-that-possible-to-choose-the-informations-to-index-in-elasticsearch/26980
**Category:** Logstash
**Created:** [August 6, 2015, 3:16pm UTC](https://discuss.elastic.co/t/is-that-possible-to-choose-the-informations-to-index-in-elasticsearch/26980 "2015-08-06T15:16:11Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ELKApprentice](https://avatars.discourse-cdn.com/v4/letter/e/5f9b8f/32.png) [@ELKApprentice](https://discuss.elastic.co/u/ELKApprentice)
#### Post date: [August 6, 2015, 3:16pm UTC](https://discuss.elastic.co/t/is-that-possible-to-choose-the-informations-to-index-in-elasticsearch/26980/1 "2015-08-06T15:16:11Z")

</div>

Hello ,

(sorry in advance for my poor english i'm french and thanks in advance for reading my topic).  
I just started using the ELK stack this morning and i was wondering if you can help me with my problème.

My logs follows this pattern :

20150703\_112230|Source17|requests/lr\_pro/source1/sitemap\_lr\_0000|subscriberNotFound|0|0|0.0292961597443 \<-web\_sophia118712,41,6,,20,,wgs84lambert2,,nbResLinking=15,crossLinking=1:2,jumptopagennn=1||| La burbanche|||01||||RUB\_807649:|1|subscriber,exact||||||||

The only informations i really need to index are from the beginning to "\<-" so :

20150703\_112230|Source17|requests/lr\_pro/source1/sitemap\_lr\_0000|subscriberNotFound|0|0|0.0292961597443

I would like to know if it is possible to configure that on my logstash configuration file on the filter part.

For now, i have :

filter {  
csv {  
separator =\> "|"  
columns =\> ["a", "b", "c", "d", "e", "f" .........., "z"]  
}  
}

but all the fields are indexed.

I hope my issue is well expressed.  
Thanks.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 6, 2015, 5:41pm UTC](https://discuss.elastic.co/t/is-that-possible-to-choose-the-informations-to-index-in-elasticsearch/26980/2 "2015-08-06T17:41:40Z")

</div>

You can e.g. use the [mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) to delete the fields you don't care about.

```
filter {
  csv {
    ...
  }
  mutate {
    remove_field => ["h", "i", "j", "k", ..., "z"]
  }
}

```

---

<div class="post-metadata">

### Author: ![ELKApprentice](https://avatars.discourse-cdn.com/v4/letter/e/5f9b8f/32.png) [@ELKApprentice](https://discuss.elastic.co/u/ELKApprentice)
#### Post date: [August 7, 2015, 8:20am UTC](https://discuss.elastic.co/t/is-that-possible-to-choose-the-informations-to-index-in-elasticsearch/26980/3 "2015-08-07T08:20:02Z")

</div>

Thank you very much sir!!!!  
That was perfect for me. 👍

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/is-that-possible-to-choose-the-informations-to-index-in-elasticsearch/26980/4 "2017-07-06T05:32:39Z")

</div>


