# Logstash adds field to output although not specified

**URL:** <https://discuss.elastic.co/t/logstash-adds-field-to-output-although-not-specified/86927>\
**Category:** Logstash\
**Created:** [May 24, 2017, 8:59am UTC](https://discuss.elastic.co/t/logstash-adds-field-to-output-although-not-specified/86927 "2017-05-24T08:59:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\
**Post date:** [May 24, 2017, 8:59am UTC](https://discuss.elastic.co/t/logstash-adds-field-to-output-although-not-specified/86927/1 "2017-05-24T08:59:39Z")

</div>

Hello,

in a test environment we collect, parse/grok firewall log messages and put them into elasticsearch - using logstash. The logs are received using _tcp_ input. In the processed logs I noticed another field which was not parsed/groked - called _port_. Somehow I realised that this port has nothing to do with the firewall logs as such but it is the port which is used on the firewall for connecting to logstash in order to forward the logs. At the end it is written to the index.

version: 5.4

Might I be missing anything here?

Regards,  
massimo

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [May 24, 2017, 4:29pm UTC](https://discuss.elastic.co/t/logstash-adds-field-to-output-although-not-specified/86927/2 "2017-05-24T16:29:28Z")

</div>

Nope. Not missing anything. This is done by many Logstash inputs. Feel free to use `mutate { remove_field =>` for any fields you don't want (excepting `@timestamp`).

---

<div class="post-metadata">

**Author:** ![massimo](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@massimo](https://discuss.elastic.co/u/massimo)\
**Post date:** [May 29, 2017, 9:18am UTC](https://discuss.elastic.co/t/logstash-adds-field-to-output-although-not-specified/86927/3 "2017-05-29T09:18:30Z")

</div>

Good, then I've ignored this completely until now. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 9:18am UTC](https://discuss.elastic.co/t/logstash-adds-field-to-output-although-not-specified/86927/4 "2017-06-26T09:18:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.