# Logstash prune nested fields
**URL:** https://discuss.elastic.co/t/logstash-prune-nested-fields/218984
**Category:** Logstash
**Created:** [February 12, 2020, 1:06pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984 "2020-02-12T13:06:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)
#### Post date: [February 12, 2020, 1:06pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984/1 "2020-02-12T13:06:23Z")
HI TEAM,
I am using ELK version 7.0. Facing an issue with prune filter.
I need to blacklist exact nested fields coming from filebeat. When i tried with below format, prune is unable to blacklist host.architecture field.
Example:
prune {
blacklist\_names =\> ["^[host][architecture]$" ]
}
Regards,
GR.
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [February 13, 2020, 2:02pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984/2 "2020-02-13T14:02:53Z")
Hi there,
I don't think prune is able to work properly with nested fields. As far as I remember there was a github issue about it.
Anyway, you could get that result with a ruby filter
```
filter {
ruby {
code => "
def remove_fields(blacklist, event)
blacklist.each { |field| event.remove(field) }
end
blacklist = [
'[host][architecture]',
'[whatever][else]'
]
remove_fields(blacklist, event)
"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 13, 2020, 2:19pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984/3 "2020-02-13T14:19:23Z")
> [@Fabio-sama](#):
>
> I don't think prune is able to work properly with nested fields. As far as I remember there was a github issue about it.
Indeed. It is a documented feature
> This filter currently only support operations on top-level fields, i.e. whitelisting and blacklisting of subfields based on name or value does not work.
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [February 13, 2020, 2:22pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984/4 "2020-02-13T14:22:32Z")
Ok I remembered well, then. Thanks for the clarification.
Yet @gangireddy_l, can you achieve what you want using the ruby filter I wrote?
Obviously you could write it like following too
```
filter {
ruby {
code => "
[
'[host][architecture]',
'[whatever][else]'
].each { |field| event.remove(field) }
"
}
}
```
but it is a bit less readable IMO.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2020, 2:22pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984/5 "2020-03-12T14:22:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.