# Logstash 5.0.2 not removing tags field

**URL:** <https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604>\
**Category:** Logstash\
**Created:** [November 30, 2016, 11:21am UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604 "2016-11-30T11:21:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![xerxes9000sx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xerxes9000sx/32/13498_2.png) [@xerxes9000sx](https://discuss.elastic.co/u/xerxes9000sx)\
**Post date:** [November 30, 2016, 11:21am UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604/1 "2016-11-30T11:21:44Z")

</div>

I remove tags wield via mutate remove\_fields statement.  
Logstash 5.0.1 and 5.0.2 is not removing tags field.  
Logstash 5.0.0 and 2.4.1 is removing tags field.

Logstash test config:  
input { stdin { tags =\> ["test"] } }  
filter { if "test" in [tags] { mutate { remove\_field =\> ["tags"] } } }  
output { stdout { codec =\> rubydebug } }

Input anything in stdin.

Output 5.0.2:  
{  
"@timestamp" =\> 2016-11-30T13:59:09.441Z,  
"@version" =\> "1",  
"host" =\> "vanilin",  
"message" =\> "test",  
**"tags" =\> []**  
}  
Output 5.0.1:  
{  
"@timestamp" =\> 2016-11-30T13:59:31.552Z,  
"@version" =\> "1",  
"host" =\> "vanilin",  
"message" =\> "test",  
**"tags" =\> []**  
}  
Output 5.0.0:  
{  
"@timestamp" =\> 2016-11-30T13:59:46.944Z,  
"@version" =\> "1",  
"host" =\> "vanilin",  
"message" =\> "test"  
}  
Output 2.4.1:  
{  
"message" =\> "test",  
"@version" =\> "1",  
"@timestamp" =\> "2016-11-30T14:00:12.034Z",  
"host" =\> "vanilin"  
}

If I add --debug switch I see all versions try remove "tags".  
[2016-11-30T17:07:41,463][DEBUG][logstash.filters.mutate] filters/LogStash::Filters::Mutate: removing field {:field=\>"tags"}  
But 5.0.1 and 5.0.2 still leave field empty.  
Look like something is changed if the grok message processing logic, is this field mandatory now?

---

<div class="post-metadata">

**Author:** ![djschny\_old](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djschny_old/32/5472_2.png) [@djschny\_old](https://discuss.elastic.co/u/djschny_old)\
**Post date:** [December 1, 2016, 4:39pm UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604/2 "2016-12-01T16:39:13Z")

</div>

I can confirm seeing this behavior as well in my testing. It causes documents to fail indexing for indices where strict mappings are used.

---

<div class="post-metadata">

**Author:** ![djschny\_old](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djschny_old/32/5472_2.png) [@djschny\_old](https://discuss.elastic.co/u/djschny_old)\
**Post date:** [December 2, 2016, 12:57am UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604/3 "2016-12-02T00:57:59Z")

</div>

@xerxes9000sx would you be willing to open a Github issue on this in the logstash repo? If not happy to do it but prefer to have it come from the community and folks who first reported it.

---

<div class="post-metadata">

**Author:** ![agrm](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@agrm](https://discuss.elastic.co/u/agrm)\
**Post date:** [December 2, 2016, 8:54am UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604/4 "2016-12-02T08:54:42Z")

</div>

I have the same issue. Any luck resolving it?

---

<div class="post-metadata">

**Author:** ![xerxes9000sx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xerxes9000sx/32/13498_2.png) [@xerxes9000sx](https://discuss.elastic.co/u/xerxes9000sx)\
**Post date:** [December 2, 2016, 8:29pm UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604/5 "2016-12-02T20:29:38Z")

</div>

My option is return to 5.0.0

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 30, 2016, 8:29pm UTC](https://discuss.elastic.co/t/logstash-5-0-2-not-removing-tags-field/67604/6 "2016-12-30T20:29:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.