# Remove a field that starts with an integer **URL:** \ **Category:** Logstash\ **Created:** [July 27, 2015, 9:43pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370 "2015-07-27T21:43:56Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 27, 2015, 9:43pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/1 "2015-07-27T21:43:56Z")
Hi Guys, I want to remove a field that starts with an integer. How can I do that using logstash. EX: of the field. "1. 2015.07.27 17": "25:35 message sent" Regards, Gabriel ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2015, 11:08pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/2 "2015-07-27T23:08:00Z")
Well if you build a grok pattern for the message and define that field, you can just use mutate and drop to remove it. ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 27, 2015, 11:31pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/3 "2015-07-27T23:31:59Z")
Hi Mark, I receive the message in JSON format ... And that field gets created every hour. I want to be able to remove it before gets inserted in ES. Regards, Gabriel ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 27, 2015, 11:33pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/4 "2015-07-27T23:33:35Z")
Ok so take a look at the mutate filter with drop 🙂 ---
**Author:** ![suyograo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suyograo/32/44898_2.png) [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Post date:** [July 28, 2015, 5:48am UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/5 "2015-07-28T05:48:25Z")
@Gabriel_Rosca so I understand, your event has a field `foo` which some times start with an int and some times does not. And you want to remove it when it starts with an int? is that correct? ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 28, 2015, 1:03pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/6 "2015-07-28T13:03:39Z")
@suyograo No. That field always starts with 1. follow my the data and hour EX: "1. 2015.07.28 08" I need to remove this field from the message before gets in to ES. something like remove\_field =\> ["^1.\*] Not sure how I can do that. Mutate filter works only if I know the name of the field. And the name of the field it is static. In this case when a new message comes I get a new field per hour. So now that is 9 AM when I get a new message ... a new field gets created and named "1. 2015.07.28 09" Regards, Gabriel ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 28, 2015, 5:46pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/7 "2015-07-28T17:46:09Z")
It's not terribly clear what's going on here. Can you provide a sample message? What is creating these fields? What's your configuration? ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 28, 2015, 6:26pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/8 "2015-07-28T18:26:58Z")
Hi Magnus, here is my config: filter { if [type] == "zabbix-alerts" { json { source =\> "message" remove\_field =\> "message" } csv { source =\> "trigger\_hostgroup\_name" columns =\> ["group1", "group2", "group3", "group4", "group5", "group6", "group7", "group8", "group9", "group10", "group11", "group12", "group13", "group14", "group15"] } mutate { gsub =\> [ "group2", "^ ", "", "group3", "^ ", "", "group4", "^ ", "", "group5", "^ ", "", "group6", "^ ", "", "group7", "^ ", "", "group8", "^ ", "", "group9", "^ ", "", "group10", "^ ", "", "group11", "^ ", "", "group12", "^ ", "", "group13", "^ ", "", "group14", "^ ", "", "group15", "^ ", "" ] } } } Here is one sample message that I received: I just want to remove the first field "1. 2015.07.28 09" which gets created ever hour as 1. date and hours 1. 2015.07.28 09 36:45 message sent Logstash [nysv0654.example.com](http://nysv0654.example.com) "Logstash User logstash (Logstash User)" @timestamp July 28th 2015, 09:41:58.129 @version 1 **name** zabbix\_data \_id AU7U5fj8aHSptZQGBhc8 \_index logstash-ptc-zabbix-alerts-2015.07.28 \_type zabbix-alerts action\_id 14 action\_name Logstash Notification date 2015.07.28 esc\_history Problem started: 2015.07.28 09:36:42 Age: 5m event\_ack\_history event\_ack\_status No event\_age 5m event\_conn1 10.250.15.111 event\_date 2015.07.28 event\_dns1 [PD-CATS-P-WEB-001.example.com](http://PD-CATS-P-WEB-001.example.com) event\_host1 [PD-CATS-P-WEB-001.example.com](http://PD-CATS-P-WEB-001.example.com) event\_id 4614976 event\_ip1 10.250.15.111 event\_name1 [PD-CATS-P-WEB-001.example.com](http://PD-CATS-P-WEB-001.example.com) event\_port1 10050 event\_recovery\_date 2015.07.28 event\_recovery\_id 4615767 event\_recovery\_status OK event\_recovery\_time 09:41:42 event\_recovery\_value 0 event\_status PROBLEM event\_time 09:36:42 event\_value 1 group1 10.250.15.0/24 group2 10.250.15.0/24 Windows Agent group3 Discovered hosts group4 PTC group5 PTC PROD group6 PTC PROD Windows group7 Windows Servers host 10.250.26.108 inventory\_contact1 inventory\_hw\_arch1 X86-based PC inventory\_model1 VMware Virtual Platform inventory\_name1 nyvm0669 inventory\_os1 Microsoft? Windows Server? 2008 Standard inventory\_poc\_primary\_phone\_b1 inventory\_poc\_primary\_screen1 inventory\_poc\_secondary\_cell1 1 inventory\_poc\_secondary\_email1 1 inventory\_poc\_secondary\_name1 1 inventory\_poc\_secondary\_notes1 inventory\_poc\_secondary\_phone\_a1 [example.com](http://example.com) inventory\_poc\_secondary\_phone\_b1 2 GB inventory\_poc\_secondary\_screen1 inventory\_serialno\_a1 VMware-42 1f 38 d0 42 14 81 ca-87 6d 54 4b 52 ef d7 43 item\_name1 Processor load (1 min average) item\_name\_orig1 Processor load (1 min average) item\_orgi1 system.cpu.load[percpu,avg1] item\_value1 3.833333 message\_type recovery node\_id1 {NODE.ID1} node\_name1 {NODE.NAME1} problem ended 2015.07.28 09:41:42 proxy\_name1 time 09:41:48 trigger\_description trigger\_events\_ack 0 trigger\_events\_problem\_ack 0 trigger\_events\_problem\_unack 523 trigger\_events\_unack 1047 trigger\_expression {[PD-CATS-P-WEB-001.example.com](http://PD-CATS-P-WEB-001.example.com):system.cpu.load[percpu,avg1].avg(5m)}\>5 trigger\_hostgroup\_name 10.250.15.0/24, 10.250.15.0/24 Windows Agent, Discovered hosts, PTC, PTC PROD, PTC PROD Windows, Windows Servers trigger\_id 16165 trigger\_name Processor load is too high on [PD-CATS-P-WEB-001.example.com](http://PD-CATS-P-WEB-001.example.com) trigger\_name\_orig Processor load is too high on {HOST.NAME} trigger\_nseverity 3 trigger\_severity Average trigger\_status OK trigger\_template\_name Custom Template OS Windows trigger\_value 0 type zabbix-alerts ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 28, 2015, 6:45pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/9 "2015-07-28T18:45:34Z")
Hi Magnus, Here is my config filter { if [type] == "zabbix-alerts" { json { source =\> "message" remove\_field =\> "message" } csv { source =\> "trigger\_hostgroup\_name" columns =\> ["group1", "group2", "group3", "group4", "group5", "group6", "group7", "group8", "group9", "group10", "group11", "group12", "group13", "group14", "group15"] } mutate { gsub =\> [ "group2", "^ ", "", "group3", "^ ", "", "group4", "^ ", "", "group5", "^ ", "", "group6", "^ ", "", "group7", "^ ", "", "group8", "^ ", "", "group9", "^ ", "", "group10", "^ ", "", "group11", "^ ", "", "group12", "^ ", "", "group13", "^ ", "", "group14", "^ ", "", "group15", "^ ", "" ] } } } and here is the json message that I received: What I want is to remove the field highlight in bold which gets created every hour { "\_index": "logstash-ptc-zabbix-alerts-2015.07.28", "\_type": "zabbix-alerts", "\_id": "AU7V5kheXErN6gNFz\_bs", "\_score": null, "\_source": { "@version": "1", "@timestamp": "2015-07-28T18:21:55.667Z", "host": "10.250.26.108", "type": "zabbix-alerts", "event\_status": "PROBLEM", "event\_ip1": "10.250.15.208", "event\_time": "14:16:37", "event\_value": "1", "event\_age": "5m", "inventory\_url\_b1": "", "trigger\_hostgroup\_name": [ "10.250.15.0/24, 10.250.15.0/24 Windows Agent, Discovered hosts, PTC, PTC PROD, PTC PROD Windows, Windows Servers" ], "inventory\_os1": "Microsoft(R) Windows(R) Server 2003, Standard Edition", "event\_ack\_status": "No", "item\_lastvalue1": "3.85", "trigger\_events\_unack": "1489", "item\_id1": "35917", "event\_recovery\_status": "OK", "inventory\_poc\_secondary\_cell1": "1", "event\_dns1": "NYVM0428", "inventory\_poc\_secondary\_phone\_a1": "[example.com](http://example.com)", "trigger\_template\_name": "UN Template OS Windows", "item\_name1": "Processor load (1 min average)", "trigger\_expression": "{NYVM0428:system.cpu.load[percpu,avg1].avg(5m)}\>5", "inventory\_model1": "VMware Virtual Platform", "action\_id": "14", "inventory\_poc\_secondary\_name1": "1", "problem ended": "2015.07.28 14:21:37", "item\_name\_orig1": "Processor load (1 min average)", "inventory\_serialno\_a1": "VMware-42 1f cb f0 57 fc d9 44-ef e2 4e 0e cd 76 94 98", "inventory\_poc\_secondary\_phone\_b1": "1023.39 MB", " **name**": "zabbix\_data", "event\_conn1": "10.250.15.208", "inventory\_vendor1": "Phoenix Technologies LTD", "event\_name1": "NYVM0428", "trigger\_value": "0", **"1. 2015.07.28 14": "16:41 message sent Logstash nysv0654 "Logstash User logstash (Logstash User)"",** "event\_port1": "10050", "trigger\_severity": "Average", "trigger\_name\_orig": "Processor load is too high on {HOST.NAME}", "event\_host1": "NYVM0428.", "inventory\_name1": "nyvm0428", "trigger\_status": "OK", "item\_key1": "system.cpu.load[percpu,avg1]", "trigger\_events\_problem\_unack": "744", "item\_value1": "3.85", "trigger\_events\_ack": "0", "event\_recovery\_time": "14:21:37", "inventory\_poc\_primary\_cell1": "", "trigger\_events\_problem\_ack": "0", "event\_recovery\_value": "0", "item\_orgi1": "system.cpu.load[percpu,avg1]", "event\_id": "4663681", "trigger\_nseverity": "3", "event\_date": "2015.07.28", "inventory\_hw\_arch1": "X86-based PC", "action\_name": "Logstash Notification", "event\_recovery\_id": "4664691", "trigger\_id": "16318", "date": "2015.07.28", "trigger\_name": "Processor load is too high on NYVM0428", "event\_recovery\_date": "2015.07.28", "time": "14:21:39", "esc\_history": "Problem started: 2015.07.28 14:16:37 Age: 5m", "message\_type": "recovery", "group1": "10.250.15.0/24", "group2": "10.250.15.0/24 Windows Agent", "group3": "Discovered hosts", "group4": "PTC", "group5": "PTC PROD", "group6": "PTC PROD Windows", "group7": "Windows Servers" }, "fields": { "@timestamp": [ 1438107715667 ] }, "sort": [ 1438107715667 ] } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 28, 2015, 7:54pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/10 "2015-07-28T19:54:59Z")
I can't find any field name or field value that contains the string "1. 2015.07.28 09" in the example that you posted. ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 28, 2015, 8:31pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/11 "2015-07-28T20:31:33Z")
I got it to work by using ruby filter ``` ruby { code => " event.to_hash.keys.each { |k| if k.start_with?('1.') event.remove(k) end } " } ``` ---
**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Post date:** [July 28, 2015, 8:43pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/12 "2015-07-28T20:43:16Z")
I mark that in bold "1. 2015.07.28 14": "16:41 message sent Logstash nysv0654 "Logstash User logstash (Logstash User)"", ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/13 "2017-07-06T05:33:33Z")