# Logstash filter only particular fields and index those fields

**URL:** <https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470>\
**Category:** Logstash\
**Created:** [April 28, 2022, 7:04am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470 "2022-04-28T07:04:32Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![venkatesh\_prasanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkatesh_prasanth/32/89319_2.png) [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\
**Post date:** [April 28, 2022, 7:04am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/1 "2022-04-28T07:04:32Z")

</div>

Hi,

I have heartbeat which pushed the data to 5044 through which logstash consumes.  
I want to index only if monitor.status is down. I am using tag heartbeat for differentiating the various beat input.

My data:  
{  
"\_index": "heartbeat-2022.04.26",  
"\_type": "\_doc",  
"\_id": "18",  
"\_version": 1,  
"\_score": null,  
"fields": {  
"monitor.status": [  
"down"  
],  
"monitor.name.text": [  
"prasanth"  
],

---

<div class="post-metadata">

**Author:** ![venkatesh\_prasanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkatesh_prasanth/32/89319_2.png) [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\
**Post date:** [April 28, 2022, 7:07am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/2 "2022-04-28T07:07:00Z")

</div>

i tried with prune but it is not whitelisting the nested field

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [April 28, 2022, 10:06am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/3 "2022-04-28T10:06:24Z")

</div>

Hi,

If i understand corretly, if monitor.status is not equal to down, then you don't send data.  
Then use drop filter in a conditionnal like this:

```auto
if [monitor.status][0] != "down" {
  drop { }
}

```

Cad.

---

<div class="post-metadata">

**Author:** ![venkatesh\_prasanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkatesh_prasanth/32/89319_2.png) [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\
**Post date:** [April 28, 2022, 11:11am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/4 "2022-04-28T11:11:46Z")

</div>

hey cad,  
Thanks, Tried that but it seems it dropping all data to the index

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [April 28, 2022, 12:51pm UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/5 "2022-04-28T12:51:25Z")

</div>

> [@venkatesh\_prasanth](#):
>
> it dropping all data to the index

well that's what you mean when you ask us previously :

> [@venkatesh\_prasanth](#):
>
> I want to index only if monitor.status is down

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 28, 2022, 4:37pm UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/6 "2022-04-28T16:37:57Z")

</div>

logstash does not use the same syntax as kibana and Elasticsearch to reference nested fields. You may want `if [monitor][status][0] != "down" {`

---

<div class="post-metadata">

**Author:** ![venkatesh\_prasanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkatesh_prasanth/32/89319_2.png) [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\
**Post date:** [April 28, 2022, 5:11pm UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/7 "2022-04-28T17:11:50Z")

</div>

Even it's dropping down status

---

<div class="post-metadata">

**Author:** ![venkatesh\_prasanth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkatesh_prasanth/32/89319_2.png) [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\
**Post date:** [April 29, 2022, 5:08am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/8 "2022-04-29T05:08:15Z")

</div>

> [@Badger](#):
>
> if [monitor][status][0] != "down" {

hi ...  
if [monitor][status][0] != "down" { does not worked but if [monitor][status] != "down" {  
worked.

Thanks both

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2022, 5:08am UTC](https://discuss.elastic.co/t/logstash-filter-only-particular-fields-and-index-those-fields/303470/9 "2022-05-27T05:08:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.