# Logstash sFlow Codec Input Syntax :: Implement "optional\_removed\_field"?

**URL:** <https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527>\
**Category:** Logstash\
**Created:** [July 16, 2020, 6:24pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527 "2020-07-16T18:24:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [July 16, 2020, 6:24pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527/1 "2020-07-16T18:24:38Z")

</div>

Hi Logstash Megaminds,

I'm using my Logstash instance as an sFlow collector, and it works great. When I read the [documentation on the sFlow Codec](https://github.com/path-network/logstash-codec-sflow/blob/master/README.md), I see this:

> By default [some sFlow] fields are removed from [every] event ... You can tune the list of removed fields by setting this parameter to the sflow codec _optional\_removed\_field_

That sounds great; I want to turn _optional\_removed\_field_ off... or on, whichever gives me the most fields. But what is the syntax here? I tried the below:

```
input {
   udp {
      port => 6343
      codec => sflow {}
      optional_removed_field => true
   }
}

```

But this caused Logstash to bellyflop pretty quickly. From the log, just before LS crashed:

`[2020-07-16T18:15:22,126][ERROR][logstash.inputs.udp] Unknown setting 'optional_removed_field' for udp`

Can someone help me with the correct syntax? Thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 16, 2020, 6:48pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527/2 "2020-07-16T18:48:01Z")

</div>

It should be an [array](https://github.com/path-network/logstash-codec-sflow/blob/89183a7a331acd912617f97b4e7074291132fa54/lib/logstash/codecs/sflow.rb#L13), and it is an option for the codec, not for the input, so I would expect

```
udp {
  port => 6343
  codec => sflow { optional_removed_field => [] }
}

```

to work.

---

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [July 16, 2020, 7:25pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527/3 "2020-07-16T19:25:41Z")

</div>

> [@Badger](#):
>
> `optional_removed_field => []`

Bingo! Yep, that worked perfectly. Thanks Badger, you save me again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 7:25pm UTC](https://discuss.elastic.co/t/logstash-sflow-codec-input-syntax-implement-optional-removed-field/241527/4 "2020-08-13T19:25:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.