# Prune filter does not work with whitelist but it does with blacklist
**URL:** https://discuss.elastic.co/t/prune-filter-does-not-work-with-whitelist-but-it-does-with-blacklist/346549
**Category:** Logstash
**Created:** [November 6, 2023, 6:21pm UTC](https://discuss.elastic.co/t/prune-filter-does-not-work-with-whitelist-but-it-does-with-blacklist/346549 "2023-11-06T18:21:51Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@elk-user-0001](https://discuss.elastic.co/u/elk-user-0001)
#### Post date: [November 6, 2023, 6:21pm UTC](https://discuss.elastic.co/t/prune-filter-does-not-work-with-whitelist-but-it-does-with-blacklist/346549/1 "2023-11-06T18:21:51Z")
Hello colleagues!
I am trying to use the prune filter with first level fields ( I know the problem with nested fields ) but I can't get it to work.
I have a json of 900 fields and I am interested in keeping only a few, I understand that the best option is the prune via whitelist however this does not work.
When I change whitelist to blacklist, logstash removes the fields I want to keep and ingest the rest.
When I set whitelist it doesn't create the index I want to send to, it's as if it drops everything.
What can cause blacklist to remove my fields of interest but whitelist does not keep them ?
filter example:
```auto
if [type] == "cloned" {
prune {
whitelist_names => ["^msg$" , "uuid"]
}
}
```
I would be very grateful for your help!
Thank you so much in advanced!
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [November 9, 2023, 8:11pm UTC](https://discuss.elastic.co/t/prune-filter-does-not-work-with-whitelist-but-it-does-with-blacklist/346549/2 "2023-11-09T20:11:15Z")
Have you solved this?
Can you show few field names? Is there any fields with similar names? E.g. time, time2, event\_time?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2023, 8:11pm UTC](https://discuss.elastic.co/t/prune-filter-does-not-work-with-whitelist-but-it-does-with-blacklist/346549/3 "2023-12-07T20:11:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.