# Logstash filter - get field?

**URL:** <https://discuss.elastic.co/t/logstash-filter-get-field/46935>\
**Category:** Logstash\
**Created:** [April 11, 2016, 3:52am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935 "2016-04-11T03:52:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)\
**Post date:** [April 11, 2016, 3:52am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/1 "2016-04-11T03:52:47Z")

</div>

I've got log lines in the following format and want to extract fields:

{  
"message" =\> "...",  
"@version" =\> "1",  
"@timestamp" =\> "2014-07-07T08:49:28.543Z",  
"host" =\> "abc",  
"field1" =\> "content1",  
"field2" =\> "content2",  
"field3" =\> "content3"  
}  
I neither know the field names, nor the number of fields.

i only want to get the "message"、"@version"、"@timestamp"、"host"、 "field1" and the content of these fields that i want , the output looks like as follows,

"message" =\> "...",  
"@version" =\> "1",  
"@timestamp" =\> "2014-07-07T08:49:28.543Z",  
"host" =\> "abc",  
"field1" =\> "content1"

Kindly help me to get required output.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 11, 2016, 3:56am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/2 "2016-04-11T03:56:21Z")

</div>

Have you seen [https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 11, 2016, 5:46am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/3 "2016-04-11T05:46:33Z")

</div>

Did you look at the prune filter?

---

<div class="post-metadata">

**Author:** ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)\
**Post date:** [April 11, 2016, 7:59am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/4 "2016-04-11T07:59:05Z")

</div>

i can get these field and content as follows,  
"message" =\> "...",  
"@version" =\> "1",  
"@timestamp" =\> "2014-07-07T08:49:28.543Z",  
"host" =\> "abc",

but I neither know the field1 names, nor the number of fields.  
the field1 is just an example  
i want to get the field that count from the message beginning of the number of sixth .

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 11, 2016, 8:11am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/5 "2016-04-11T08:11:32Z")

</div>

So this is the exact same problem as in the other thread? Then I suggest we keep it in one thread and close this one.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 11, 2016, 8:24am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/6 "2016-04-11T08:24:11Z")

</div>

Good point, let's keep it in here - [How to remove dynamical field?](https://discuss.elastic.co/t/how-to-remove-dynamical-field/46772/12)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 11, 2016, 8:24am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935/7 "2016-04-11T08:24:16Z")

</div>