# JSON Plugin - Ignore Field

**URL:** <https://discuss.elastic.co/t/json-plugin-ignore-field/315510>\
**Category:** Logstash\
**Created:** [September 30, 2022, 1:57am UTC](https://discuss.elastic.co/t/json-plugin-ignore-field/315510 "2022-09-30T01:57:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![QuestBevan](https://avatars.discourse-cdn.com/v4/letter/q/858c86/32.png) [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\
**Post date:** [September 30, 2022, 1:57am UTC](https://discuss.elastic.co/t/json-plugin-ignore-field/315510/1 "2022-09-30T01:57:39Z")

</div>

Hi All,

Need some advise.

I am currently using filebeat, to send logs to Elasticsearch via Logstash.  
Filebeat -\> Logstash -\> Elasticsearch

Log files are in JSON, and these JSON documents are being expanded as expected. My problem is, I have a JSON field that I don't want to expand, and would prefer to ingest it as "text/string". How can I alter my Logstash filter to not expand that field. The field I don't want to expand is payload.attestation

JSON document looks something like this

```auto
{
  "eventId": "9686df",
  "level": "debug",
  "message": "JSON payload",
  "payload": {
    "attestation": {
      "value1": "HASH-aaa-aaa",
      "value2": "bbb",
      "value3": "ccc",
      "value4": "ddd"
    }
  },
  "serial": "1234",
  "timestamp": "2022-09-27T11:02:13.361+10:00"
}

```

Current filter looks like this:

```auto
        mutate {
            add_field => {"json_payload" => ""}
            copy => { "message" => "json_payload" }
        }
        json {
            source => "message"
        }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 30, 2022, 3:37am UTC](https://discuss.elastic.co/t/json-plugin-ignore-field/315510/2 "2022-09-30T03:37:20Z")

</div>

[This](https://discuss.elastic.co/t/how-to-prevent-json-parsing-of-a-field-in-logstash/178270/2) answer might help, or [this](https://discuss.elastic.co/t/mongodb-5-json-based-some-objects-have-variable-types/312445/3) one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2022, 3:37am UTC](https://discuss.elastic.co/t/json-plugin-ignore-field/315510/3 "2022-10-28T03:37:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.