# Packetbeat: Disable request parameters from http request to Elasticsearch **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [June 9, 2016, 7:36am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295 "2016-06-09T07:36:27Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![talk2cshah](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Post date:** [June 9, 2016, 7:36am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/1 "2016-06-09T07:36:27Z")
Dear Team, May I request some to guide on how to configure packetbeat to avoid packetbeat pushing request(GET/POST) parameters to elasticsearch servers. this makes the payload huge. Look forward to the response. Regards, ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 9, 2016, 1:44pm UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/2 "2016-06-09T13:44:20Z")
What's the exact problem with hughe payload? The generated document/event being to big or network usage? At the moment one has to forward to logstash in order to manipulate the events before pushing to elasticsearch. With 5.0 release (currently at alpha3) we're adding some filtering support for selectively removing fields from events. [See doc](https://www.elastic.co/guide/en/beats/packetbeat/master/configuration-filter.html). In addition elasticsearch 5.0 will come with 'ingest node' support for setting up simple processing pipelines on ingest in elasticsearch. ---
**Author:** ![talk2cshah](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Post date:** [June 9, 2016, 2:57pm UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/3 "2016-06-09T14:57:36Z")
Dear Stefen, The document is huge and if it happens then storage increases drastically apart from network load. I understand the data manipulation through logstash but I think configuration should be an easy option if possible.... since it is more catch or drop... Regards, ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [June 10, 2016, 6:18am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/4 "2016-06-10T06:18:36Z")
Perhaps filters could help you here (some only in 5.0.0): [https://www.elastic.co/guide/en/beats/packetbeat/master/configuration-filter.html](https://www.elastic.co/guide/en/beats/packetbeat/master/configuration-filter.html) ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 10, 2016, 10:39am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/5 "2016-06-10T10:39:16Z")
I think generic filtering in beats would help then (currently available in 5.0alpha3). See links posted by @ruflin and me. ---
**Author:** ![talk2cshah](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@talk2cshah](https://discuss.elastic.co/u/talk2cshah)\ **Post date:** [June 15, 2016, 8:12am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/6 "2016-06-15T08:12:05Z")
I understand.. but migration will call for impact analysis in comparison to earlier version. Is impact analysis put down somewhere by someone... or again poc driven? Regards! ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [June 15, 2016, 8:58am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/7 "2016-06-15T08:58:01Z")
generic filtering is quite a new feature. We're working on getting some automated benchmarks in general, but nothing available in near future. Still, I'd expect filter performance heavily depending on actual event size and conditions being applied. ---
**Author:** ![billzy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/billzy/32/9967_2.png) [@billzy](https://discuss.elastic.co/u/billzy)\ **Post date:** [June 16, 2016, 3:02am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/8 "2016-06-16T03:02:59Z")
If you dont' use logstash as output, seems the only way to modify fields in current stable version is to change the source code and compile it, it worked for me. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 30, 2016, 7:37am UTC](https://discuss.elastic.co/t/packetbeat-disable-request-parameters-from-http-request-to-elasticsearch/52295/9 "2016-06-30T07:37:06Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.