# Remove field after parsing json

**URL:** https://discuss.elastic.co/t/remove-field-after-parsing-json/299973
**Category:** Logstash
**Created:** [March 17, 2022, 3:59pm UTC](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973 "2022-03-17T15:59:26Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![raspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raspi/32/103179_2.png) [@raspi](https://discuss.elastic.co/u/raspi)
#### Post date: [March 17, 2022, 3:59pm UTC](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973/1 "2022-03-17T15:59:26Z")

</div>

Hello

i need help please

this is my logstash.conf

\<  
filter {

```
if "jaeger" in [message] {
	drop { }
}

mutate {
	gsub => ["message", '"message":', '"containerlogs":']
	remove_tag => ["pfd", "middle", "fluentd", "beats_input_codec_plain_applied"]
}

grok {
	match => { "message" => "^%{SYSLOGTIMESTAMP:integration_date} %{HOSTNAME:host_caas} fluentd %{GREEDYDATA:json_message}$"}
}

mutate {
	remove_field => ["message"]
}

json {
	source => "json_message"
	target => "message_json"
}

if ("" in [message_json][containerlogs]){
	mutate { add_tag => "text" }   
	mutate {
		rename => {"[message_json][containerlogs]" => "[message_json][containerlogstext]"}
	}
}else{
	mutate { add_tag => "json" }
}

if [message_json][containerlogs][application] == "ApiGateway-Hydra" {
	grok {
		match => { "[message_json][containerlogs][msg]" => "%{IP:access.http_request.host} %{USER:access.http_request.identite} %{USER:access.http_request.userid} \[%{HTTPDATE:access.http_request.timestamp}\] \"%{WORD:access.http_request.method} %{NOTSPACE:access.http_request.path} %{NOTSPACE:access.http_request.http_version}\" %{NUMBER:access.http_response.status} %{NUMBER:access.http_response.size} %{NUMBER:access.http_response.time}"} 

		add_tag => ["access", "apigateway-hydra"]
		}
	if "_grokparsefailure" in [tags] {

	grok {	
		match => { "[message_json][containerlogs][msg]" => "%{GREEDYDATA:application_message}$"}
		
		add_tag => ["application", "apigateway-hydra"]
		remove_tag => "_grokparsefailure"
			}
	}
	}

```

}  
/\>

after the filed result in kibana is something like that:

message\_json.containerlogs.logger  
message\_json.containerlogs.level  
message\_json.kubernetes.container\_name

i would like to remove field message\_json.containerlogs and message\_json.kubernetes just keep logger, level and container\_name

How can i do?

Thanks

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 17, 2022, 4:02pm UTC](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973/2 "2022-03-17T16:02:18Z")

</div>

Just use another mutate filter.

```auto
mutate {
    remove_field => ["[message_json][containerlogs][logger]", "[message_json][containerlogs][level]", "[message_json][kubernetes][container_name]"]
} 

```

---

<div class="post-metadata">

### Author: ![raspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raspi/32/103179_2.png) [@raspi](https://discuss.elastic.co/u/raspi)
#### Post date: [March 17, 2022, 5:27pm UTC](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973/3 "2022-03-17T17:27:35Z")

</div>

Thanks for your answer.  
I don't want remove my filed but i want to rename it.

i have a lot line who begin by message\_json.containerlogs or message\_json.kubernetes.container\_name

i don't want rename one by one.

i hope they have a command to do that

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 14, 2022, 5:28pm UTC](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973/4 "2022-04-14T17:28:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.