# Remove a field that starts with an integer

**URL:** <https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370>\
**Category:** Logstash\
**Created:** [July 27, 2015, 9:43pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370 "2015-07-27T21:43:56Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![Gabriel\_Rosca](https://avatars.discourse-cdn.com/v4/letter/g/e19adc/32.png) [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\
**Post date:** [July 28, 2015, 6:45pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/9 "2015-07-28T18:45:34Z")

</div>

Hi Magnus,

Here is my config

filter {  
if [type] == "zabbix-alerts" {  
json {  
source =\> "message"  
remove\_field =\> "message"  
}  
csv {  
source =\> "trigger\_hostgroup\_name"  
columns =\> ["group1", "group2", "group3", "group4", "group5", "group6", "group7", "group8", "group9", "group10", "group11", "group12", "group13", "group14", "group15"]  
}  
mutate {  
gsub =\> [  
"group2", "^ ", "",  
"group3", "^ ", "",  
"group4", "^ ", "",  
"group5", "^ ", "",  
"group6", "^ ", "",  
"group7", "^ ", "",  
"group8", "^ ", "",  
"group9", "^ ", "",  
"group10", "^ ", "",  
"group11", "^ ", "",  
"group12", "^ ", "",  
"group13", "^ ", "",  
"group14", "^ ", "",  
"group15", "^ ", ""  
]  
}  
}  
}

and here is the json message that I received:

What I want is to remove the field highlight in bold which gets created every hour

{  
"\_index": "logstash-ptc-zabbix-alerts-2015.07.28",  
"\_type": "zabbix-alerts",  
"\_id": "AU7V5kheXErN6gNFz\_bs",  
"\_score": null,  
"\_source": {  
"@version": "1",  
"@timestamp": "2015-07-28T18:21:55.667Z",  
"host": "10.250.26.108",  
"type": "zabbix-alerts",  
"event\_status": "PROBLEM",  
"event\_ip1": "10.250.15.208",  
"event\_time": "14:16:37",  
"event\_value": "1",  
"event\_age": "5m",  
"inventory\_url\_b1": "",  
"trigger\_hostgroup\_name": [  
"10.250.15.0/24, 10.250.15.0/24 Windows Agent, Discovered hosts, PTC, PTC PROD, PTC PROD Windows, Windows Servers"  
],  
"inventory\_os1": "Microsoft(R) Windows(R) Server 2003, Standard Edition",  
"event\_ack\_status": "No",  
"item\_lastvalue1": "3.85",  
"trigger\_events\_unack": "1489",  
"item\_id1": "35917",  
"event\_recovery\_status": "OK",  
"inventory\_poc\_secondary\_cell1": "1",  
"event\_dns1": "NYVM0428",  
"inventory\_poc\_secondary\_phone\_a1": "[example.com](http://example.com)",  
"trigger\_template\_name": "UN Template OS Windows",  
"item\_name1": "Processor load (1 min average)",  
"trigger\_expression": "{NYVM0428:system.cpu.load[percpu,avg1].avg(5m)}\>5",  
"inventory\_model1": "VMware Virtual Platform",  
"action\_id": "14",  
"inventory\_poc\_secondary\_name1": "1",  
"problem ended": "2015.07.28 14:21:37",  
"item\_name\_orig1": "Processor load (1 min average)",  
"inventory\_serialno\_a1": "VMware-42 1f cb f0 57 fc d9 44-ef e2 4e 0e cd 76 94 98",  
"inventory\_poc\_secondary\_phone\_b1": "1023.39 MB",  
" **name**": "zabbix\_data",  
"event\_conn1": "10.250.15.208",  
"inventory\_vendor1": "Phoenix Technologies LTD",  
"event\_name1": "NYVM0428",  
"trigger\_value": "0",  
**"1. 2015.07.28 14": "16:41 message sent Logstash nysv0654 "Logstash User logstash (Logstash User)"",**  
"event\_port1": "10050",  
"trigger\_severity": "Average",  
"trigger\_name\_orig": "Processor load is too high on {HOST.NAME}",  
"event\_host1": "NYVM0428.",  
"inventory\_name1": "nyvm0428",  
"trigger\_status": "OK",  
"item\_key1": "system.cpu.load[percpu,avg1]",  
"trigger\_events\_problem\_unack": "744",  
"item\_value1": "3.85",  
"trigger\_events\_ack": "0",  
"event\_recovery\_time": "14:21:37",  
"inventory\_poc\_primary\_cell1": "",  
"trigger\_events\_problem\_ack": "0",  
"event\_recovery\_value": "0",  
"item\_orgi1": "system.cpu.load[percpu,avg1]",  
"event\_id": "4663681",  
"trigger\_nseverity": "3",  
"event\_date": "2015.07.28",  
"inventory\_hw\_arch1": "X86-based PC",  
"action\_name": "Logstash Notification",  
"event\_recovery\_id": "4664691",  
"trigger\_id": "16318",  
"date": "2015.07.28",  
"trigger\_name": "Processor load is too high on NYVM0428",  
"event\_recovery\_date": "2015.07.28",  
"time": "14:21:39",  
"esc\_history": "Problem started: 2015.07.28 14:16:37 Age: 5m",  
"message\_type": "recovery",  
"group1": "10.250.15.0/24",  
"group2": "10.250.15.0/24 Windows Agent",  
"group3": "Discovered hosts",  
"group4": "PTC",  
"group5": "PTC PROD",  
"group6": "PTC PROD Windows",  
"group7": "Windows Servers"  
},  
"fields": {  
"@timestamp": [  
1438107715667  
]  
},  
"sort": [  
1438107715667  
]  
}

---

_[View the full topic](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370)._