# Parsing a logstash file

**URL:** <https://discuss.elastic.co/t/parsing-a-logstash-file/383788>\
**Category:** Logs\
**Created:** [December 1, 2025, 4:41pm UTC](https://discuss.elastic.co/t/parsing-a-logstash-file/383788 "2025-12-01T16:41:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DOkuwa](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\
**Post date:** [December 1, 2025, 4:41pm UTC](https://discuss.elastic.co/t/parsing-a-logstash-file/383788/1 "2025-12-01T16:41:34Z")

</div>

I want to parse my logstash file to be able to delete some unnecessary fields that appear in kibana

This is the input file from filebeat

```auto
{
  "source": "10.200.226.62:57500",
  "subscription-name": "default-1764331045",
  "timestamp": 1764328788493751000,
  "time": "2025-11-28T12:19:48.493751+01:00",
  "updates": [
    {
      "Path": "interfaces/interface[name=GigabitEthernet0/0]/state/counters/out-
octets",
      "values": {
        "interfaces/interface/state/counters/out-octets": "334577330"
      }
    }
  ]
}
{
  "source": "10.200.10.10:57500",
  "subscription-name": "default-1764331045",
  "timestamp": 1764328788497842000,
  "time": "2025-11-28T12:19:48.497842+01:00"
}
{
  "sync-response": true
}
{
  "source": "10.200.10.10:57500",
  "subscription-name": "default-1764331045",
  "timestamp": 1764328798498615000,
  "time": "2025-11-28T12:19:58.498615+01:00",
  "updates": [
    {
      "Path": "interfaces/interface[name=GigabitEthernet0/0]/state/counters/out-octets",
      "values": {
        "interfaces/interface/state/counters/out-octets": "334579570"
      }
    }
  ]

```

This is an example of the logstash file

```auto
input {
  beats {
    port => 5044
  }
}

filter {

}

output {
  stdout { codec => rubydebug }
    elasticsearch {
    hosts => ["https://localhost:9200"]
    index => "telegraf-logstash"
    user => "elastic"
    password => "xxxxxxxxx"
    ssl_enabled => true
    ssl_certificate_authorities => ["/etc/elasticsearch/certs/http_ca.crt"]
  }
}

```

this is the output

```auto

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10c217e0aa948318734a1dca83d1f5e4eef4d703.png)

I dont want fields like host architecture etc

Thanks

I dont want all this

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [December 1, 2025, 5:56pm UTC](https://discuss.elastic.co/t/parsing-a-logstash-file/383788/2 "2025-12-01T17:56:07Z")

</div>

Look in your beats config for

> #The following example enriches each event with host  
> #metadata.
> 
> processors:  
> add\_host\_metadata: ~

If it’s there, comment it out.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [December 1, 2025, 6:08pm UTC](https://discuss.elastic.co/t/parsing-a-logstash-file/383788/3 "2025-12-01T18:08:53Z")

</div>

Also you can drop fields in filebeat.yml:

```auto
processors:
  - add_host_metadata: ...
  
  - drop_fields:
      fields: ["agent.version","agent.type","agent.id","agent.ephemeral_id","host","mac","ip","log.file.vol","log.file.idxhi","log.file.idxlo","log.offset"]
      ignore_missing: true

```

Just adopt list.

Of couse, you can delete in LS:

```auto
mutate {
       remove_field => ["agent", "host"]
     }

```