# Remove event received from Metricbeat to Logstash

**URL:** <https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [May 11, 2017, 6:44am UTC](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336 "2017-05-11T06:44:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumitbiswas](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\
**Post date:** [May 11, 2017, 6:44am UTC](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336/1 "2017-05-11T06:44:44Z")

</div>

Hi,

I am using a setup where Metricbeat running in remote server sends data to Logstash.

Metricbeat sends tons of data to Logstash and I don't want everything to be stored by Elasticsearch.

At each interval, Logstash receives from Metricbeat as below which are in 100s of different event.

> [2017-05-11T02:30:46,633][DEBUG][logstash.pipeline] output received {"event"=\>{"@timestamp"=\>2017-05-11T06:20:49.399Z, "system"=\>{"process"=\>{"memory"=\>{"rss"=\>{"pct"=\>0.0, "bytes"=\>0}, "size"=\>0, "share"=\>0}, "pgid"=\>0, "name"=\>"scsi\_eh\_3", **"cpu"=\>{"start\_time"** =\>"2017-02-23T18:26:49.000Z", "total"=\>{"pct"=\>0.0}}, "pid"=\>657, "state"=\>"sleeping", "fd"=\>{"limit"=\>{"hard"=\>4096, "soft"=\>1024}, "open"=\>0}, "username"=\>"root", "ppid"=\>2}}, "beat"=\>{"hostname"=\>"pte401", "name"=\>"pte401", "version"=\>"5.3.2"}, "@version"=\>"1", "host"=\>"pte401", "metricset"=\>{"rtt"=\>218091, "module"=\>"system", "name"=\>"process"}, "type"=\>"metricsets", "tags"=\>["beats\_input\_raw\_event"]}}

I don't want \_"cpu"=\>{"start\_time"} to be stored. Let's take it that is of no use for me.

How do I remove it from Logstash filter, so that it is not stored in Elasticsearch? Can you please help?

I tried to use as below, but it didn't help. I see it in Kibana still there.

> mutate {  
> remove\_field =\> ["system.process.memory.share", "system.process.cpu.start\_time"]  
> }

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [May 11, 2017, 7:28am UTC](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336/2 "2017-05-11T07:28:47Z")

</div>

Should be...

```
mutate {
    remove_field => ["[system][process][memory][share]", "[system][process][cpu][start_time]" ]
}
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 11, 2017, 10:28am UTC](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336/3 "2017-05-11T10:28:03Z")

</div>

I'd prefer not to even ship unwanted data. See [metricbeat drop\_fields](https://www.elastic.co/guide/en/beats/metricbeat/current/drop-fields.html) processor to remove fields before even sending to Logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 10:37am UTC](https://discuss.elastic.co/t/remove-event-received-from-metricbeat-to-logstash/85336/4 "2017-06-08T10:37:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.