# Logstash filter target操作之后remove\_field无法删除子字段

**URL:** <https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486>\
**Category:** 中文提问与讨论\
**Created:** [July 11, 2018, 6:55am UTC](https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486 "2018-07-11T06:55:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hjfeng1988](https://avatars.discourse-cdn.com/v4/letter/h/df788c/32.png) [@hjfeng1988](https://discuss.elastic.co/u/hjfeng1988)\
**Post date:** [July 11, 2018, 6:56am UTC](https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486/1 "2018-07-11T06:56:00Z")

</div>

```auto
        grok {
            match => { "message" => "%{HTTPD_COMBINEDLOG}" }
            remove_field => ["message"]
        }
        useragent {
            source => "agent"
            target => "ua"
            remove_field => ["agent"]
            remove_field => ["ua.patch"]
            remove_field => ["ua.build"]
        }

```

配置如上，`agent`字段删除成功，但是`ua.patch`和`ua.build`删除失败，谁知道什么原因请告诉我，谢谢。

---

<div class="post-metadata">

**Author:** ![hjfeng1988](https://avatars.discourse-cdn.com/v4/letter/h/df788c/32.png) [@hjfeng1988](https://discuss.elastic.co/u/hjfeng1988)\
**Post date:** [July 11, 2018, 7:12am UTC](https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486/2 "2018-07-11T07:12:37Z")

</div>

```auto
        grok {
            match => { "message" => "%{HTTPD_COMBINEDLOG}" }
            remove_field => ["message"]
        }
        useragent {
            source => "agent"
            target => "ua"
            remove_field => ["agent","[ua][patch]" ]
            remove_field => ["[ua][build]" ]
        }

```

`remove_field => ["agent","[ua][patch]","[ua][build]" ]`建议写成一行  
修改成如下。

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2018, 7:12am UTC](https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486/3 "2018-08-08T07:12:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.