# Opposite of "Append" processor?
**URL:** https://discuss.elastic.co/t/opposite-of-append-processor/355095
**Category:** Kibana
**Created:** [March 10, 2024, 12:18pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095 "2024-03-10T12:18:44Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Balu](https://discuss.elastic.co/u/Balu)
#### Post date: [March 10, 2024, 12:18pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/1 "2024-03-10T12:18:44Z")
Hell guys,
what ingest processor can I use to remove an item from an array?
In my case I want to remove an "error tag" that was added to the "tags" field.
---
### Author:  [@jessgarson](https://discuss.elastic.co/u/jessgarson)
#### Post date: [March 12, 2024, 12:30pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/2 "2024-03-12T12:30:35Z")
Hi @Balu,
Would the [remove processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/remove-processor.html) be what you are looking for?
Hope this helps!
Jess
---
### Author:  [@Balu](https://discuss.elastic.co/u/Balu)
#### Post date: [March 12, 2024, 1:17pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/3 "2024-03-12T13:17:53Z")
The remove processor removes the whole field, not just an element in it?
In my example the whole "tags" field would be gone, not just the "error tag" which is one of multiple.
I am looking for the opposite processor to "Append".
PS: I just realized I've said "Hell" instead of "Hello" in my original post. 😲 - Sorry
---
### Author:  [@jessgarson](https://discuss.elastic.co/u/jessgarson)
#### Post date: [March 12, 2024, 1:51pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/4 "2024-03-12T13:51:42Z")
Thanks for your reply @Balu
No worries! I figured that was a typo.
You are correct. The remove processor removes all the fields. I'm not aware of a processor that is the opposite of append. Have you considered using a [script processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/script-processor.html) to go through the array and remove the error tags?
---
### Author:  [@Balu](https://discuss.elastic.co/u/Balu)
#### Post date: [March 12, 2024, 2:43pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/5 "2024-03-12T14:43:49Z")
I have, but for me it's not as "painless" as I'd hope it to be 😉. I need to learn the language more before I can do so.
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 12, 2024, 3:09pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/6 "2024-03-12T15:09:54Z")
May be some inspiration could come from [Removing elements from an array in a document](https://discuss.elastic.co/t/10156/)
---
### Author:  [@Balu](https://discuss.elastic.co/u/Balu)
#### Post date: [March 14, 2024, 9:48am UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/7 "2024-03-14T09:48:47Z")
The scripting documentation [has an example](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting-using.html#scripts-update-scripts) too.
So I tried this:
```auto
if (ctx._source.tags.contains('_grok_dovecot_nomatch')) {
ctx._source.tags.remove(ctx._source.tags.indexOf('_grok_dovecot_nomatch'))
}
```
But I get a `null pointer exception`: `cannot access method/field [tags] from a null def reference` with a pointer to the `_source` element.
The document I am using is from the index and has `_source`. So I am not sure where that is coming from.
```auto
[
{
"_id": "o7U4PI4BdgQegvMfNBhs",
"_index": ".ds-logs-logs-default-2024.03.04-000004",
"_source": {
...
"message": "imap-postlogin: user=abc, homedir=/..., rip=10.0.0.1, lip=127.0.0.1, arguments=/...",
"tags": [
"journald-log",
"_grokparsefailure",
"_grok_dovecot_nomatch"
],
...
"@timestamp": "2024-03-14T09:08:15.503Z",
...
}
}
]
```
I had also tried the shorter version with the same result:
```auto
ctx._source.tags.remove('_grok_dovecot_nomatch')
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 14, 2024, 10:06am UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/8 "2024-03-14T10:06:39Z")
Could you share a complete example of a `_simulate` call? So we can iterate from this? Like [this example](https://www.elastic.co/guide/en/elasticsearch/reference/current/simulate-pipeline-api.html#simulate-pipeline-api-request-body-ex).
---
### Author:  [@Balu](https://discuss.elastic.co/u/Balu)
#### Post date: [March 14, 2024, 10:54am UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/9 "2024-03-14T10:54:52Z")
Sure.
```auto
POST /_ingest/pipeline/_simulate
{
"pipeline" :
{
"description": "_description",
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"%{IMAP_POSTLOGIN_WORD:dovecot.service}: user=%{DOVECOT_USER:dovecot.user}, homedir=%{DATA:dovecot.homedir}, rip=%{IP:dovecot.rip}, lip=%{IP:dovecot.lip}, arguments=%{DATA:dovecot.arguments},"
],
"pattern_definitions": {
"DOVECOT_USER": "%{USERNAME}|%{EMAILADDRESS}|%{DATA}",
"IMAP_POSTLOGIN_WORD": "imap-postlogin"
},
"ignore_missing": true,
"ignore_failure": true
}
},
{
"script": {
"source": "if (ctx._source.tags.contains('_grokparsefailure')) { \n ctx._source.tags.remove(ctx._source.tags.indexOf('_grokparsefailure')) \n}",
"if": "ctx?.dovecot?.service == 'imap-postlogin'"
}
}
]
},
"docs": [
{
"_index": "index",
"_id": "id",
"_source": {
"message": "imap-postlogin: user=us@r, homedir=/.../, rip=10.0.0.1, lip=127.0.0.1, arguments=/.../,",
"tags": [
"journald-log",
"_grokparsefailure"
]
}
}
]
}
```
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 14, 2024, 11:16am UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/10 "2024-03-14T11:16:58Z")
Try:
```auto
POST /_ingest/pipeline/_simulate
{
"pipeline" :
{
"description": "_description",
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"%{IMAP_POSTLOGIN_WORD:dovecot.service}: user=%{DOVECOT_USER:dovecot.user}, homedir=%{DATA:dovecot.homedir}, rip=%{IP:dovecot.rip}, lip=%{IP:dovecot.lip}, arguments=%{DATA:dovecot.arguments},"
],
"pattern_definitions": {
"DOVECOT_USER": "%{USERNAME}|%{EMAILADDRESS}|%{DATA}",
"IMAP_POSTLOGIN_WORD": "imap-postlogin"
},
"ignore_missing": true,
"ignore_failure": true
}
},
{
"script": {
"source": """
if (ctx.tags != null && ctx.tags.contains('_grokparsefailure')) {
ctx.tags.remove(ctx.tags.indexOf('_grokparsefailure'));
}""",
"if": "ctx?.dovecot?.service == 'imap-postlogin'"
}
}
]
},
"docs": [
{
"_index": "index",
"_id": "id",
"_source": {
"message": "imap-postlogin: user=us@r, homedir=/.../, rip=10.0.0.1, lip=127.0.0.1, arguments=/.../,",
"tags": [
"journald-log",
"_grokparsefailure"
]
}
}
]
}
```
---
### Author:  [@Balu](https://discuss.elastic.co/u/Balu)
#### Post date: [March 14, 2024, 1:16pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/11 "2024-03-14T13:16:02Z")
This seems to work. Thank you.
I do understand the extra check for `ctx.tags != null`, but I'm still confused when to use `_source` and when not.
The context in processors already is the `_source` document, but if I run a script somewhere else, it's not?
PS: An extra processor would make this easier though. 😉
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 11, 2024, 1:16pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095/12 "2024-04-11T13:16:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.