# Mutate remove\_field not working for JSON field

**URL:** <https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482>\
**Category:** Logstash\
**Created:** [June 10, 2016, 9:09pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482 "2016-06-10T21:09:16Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mick\_Mahoney](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)\
**Post date:** [June 10, 2016, 9:09pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/1 "2016-06-10T21:09:16Z")

</div>

Appreciate it if someone can spot the problem with this.  
Trying to remove the [beat][name] field. I'm not getting any errors but the field is not getting removed.

Can anyone spot why please ?

# JSON input

{  
"@timestamp" =\> "2016-06-10T20:39:50.836Z",  
"beat" =\> {  
"hostname" =\> "serverName",  
"name" =\> "serverName"  
},  
"cpu" =\> {  
"idle" =\> 195218681,  
"iowait" =\> 205653,  
"irq" =\> 57,  
"nice" =\> 107761,  
"softirq" =\> 12225,  
"steal" =\> 0,  
"system" =\> 1583749,  
"system\_p" =\> 0.6,  
"user" =\> 3125617,  
"user\_p" =\> 1.5  
},  
"type" =\> "system",  
"@version" =\> "1",  
"category" =\> "app",  
"alias" =\> "app3",  
"indextype" =\> "system"  
}

# FILTER

filter {  
mutate {  
remove\_field =\> ["event['beat']['name']" ]  
}  
}

---

<div class="post-metadata">

**Author:** ![marke72](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marke72/32/10832_2.png) [@marke72](https://discuss.elastic.co/u/marke72)\
**Post date:** [June 10, 2016, 9:11pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/2 "2016-06-10T21:11:27Z")

</div>

Try `remove_field => ["[beat][name]" ]`

---

<div class="post-metadata">

**Author:** ![Mick\_Mahoney](https://avatars.discourse-cdn.com/v4/letter/m/cab0a1/32.png) [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)\
**Post date:** [June 10, 2016, 9:18pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/3 "2016-06-10T21:18:47Z")

</div>

Worked ! Many Thanks marke72

Being a newbie with logstash I dont understand why sometimes I use:

event['field']['subfield']

but in this case I use

[field][subfield]

It would be great if someone could explain that 🙂 ?

---

<div class="post-metadata">

**Author:** ![marke72](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marke72/32/10832_2.png) [@marke72](https://discuss.elastic.co/u/marke72)\
**Post date:** [June 10, 2016, 9:26pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/4 "2016-06-10T21:26:01Z")

</div>

`beat` is an array of fields. One of those fields is `name`. Another field in the array in your case is `hostname`. `"[beat][hostname]"` and `"[beat][name]"`. It's just how you reference them in Logstash. Also if you look at `cpu` it's an array of fields as well.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 14, 2016, 6:35pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/5 "2016-06-14T18:35:14Z")

</div>

The `event['field']['subfield']` notation is _only_ used within ruby filters.

---

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 9, 2017, 1:02pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/6 "2017-02-09T13:02:41Z")

</div>

What is the proper way to remove `beat.name` field in Ingest pipeline?  
I tried  
`"remove" : { "field": "beat.name" },`

but it does not work (field still present in ES).

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 9, 2017, 2:02pm UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/7 "2017-02-09T14:02:49Z")

</div>

@John16, I suggest you ask your question in the Elasticsearch group.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/mutate-remove-field-not-working-for-json-field/52482/8 "2017-07-06T04:28:44Z")

</div>