# Remove a field from logstash

**URL:** <https://discuss.elastic.co/t/remove-a-field-from-logstash/92677>\
**Category:** Logstash\
**Created:** [July 11, 2017, 3:10pm UTC](https://discuss.elastic.co/t/remove-a-field-from-logstash/92677 "2017-07-11T15:10:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![baha1](https://avatars.discourse-cdn.com/v4/letter/b/b77776/32.png) [@baha1](https://discuss.elastic.co/u/baha1)\
**Post date:** [July 11, 2017, 3:10pm UTC](https://discuss.elastic.co/t/remove-a-field-from-logstash/92677/1 "2017-07-11T15:10:08Z")

</div>

Hi there,  
I am using logStash to index log file in ElasticSearch.I get this result:

```
{
_index: "errors",
_type: "error",
_id: "AV0sjSUzkDeT3TJ69hAm",
_score: 1,
_source: {
date: "16:54:46,235",
path: "c:/logstash.log",
@timestamp: "2017-07-10T12:50:33.720Z",
level: "ERROR",
@version: "1",
host: "HosteName",
message: "[stderr] (ServerService Thread Pool -- 42) at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:111)"
}}

```

My question is how to remove or rename the field `@timestamp` and `@version`.  
This is my pipeline.conf for more detail:

```
input {
        file {
        path => "c:/logstash.log"
        start_position => "beginning"
        sincedb_path => "/dev/null"
        codec => multiline {
        pattern => "^%{TIME}"
        negate => true
        what => previous
   } }}
filter {
grok{
	  match => { "message" => "%{TIME:date} %{LOGLEVEL:level} %{GREEDYDATA:message}" }
    remove_tag => ["_grokparsefailure"]
    remove_tag => ["multiline"]
    overwrite => ["message"]
}}
output {
if	"ERROR" in [level]
{
elasticsearch {
  hosts=>"localhost:9200"
  index => "errors"
  document_type => "error"
  } }
stdout { codec => rubydebug }
}

```

Any help is greatly appreciate.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2017, 3:10pm UTC](https://discuss.elastic.co/t/remove-a-field-from-logstash/92677/2 "2017-08-08T15:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.