# Remove field based on name regex
**URL:** https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326
**Category:** Logstash
**Created:** [October 6, 2016, 3:13am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326 "2016-10-06T03:13:22Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [October 6, 2016, 3:13am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326/1 "2016-10-06T03:13:22Z")
This is the data I'm receiving:
```
"mem" => {
"total" => 8201703424,
"used" => 6293446656,
"free" => 1908256768,
"used_p" => 0.77,
"actual_used" => 5523927040,
"actual_free" => 2677776384,
"actual_used_p" => 0.67
},
```
Right now I only need to keep "[mem][used\_p]" so I have my filter like this:
> remove\_field =\> ["[mem][total]", "[mem][used]", "[mem][free]", "[mem][actual\_used]", "[mem][actual\_free]", "[mem][actual\_used\_p]" ]
Is there any way to do this with a regex to remove all nested fields that are NOT "used\_p" so my config looks cleaner and it's easier to modify?
I'm asking because there's lots of use cases I could have. I also have one nested field which I only need "[when][\_d]" but to remove all fields it's set up like this:
> remove\_field =\> ["[when][\_locale]", "[when][\_d]", "serverName", "[when][\_isAMomentObject]", "[when][\_isUTC]", "[when][\_pf]", "[when][empty]", "[when][unusedTokens]", "[when][unusedInput]", "[when][unusedInput]", "[when][overflow]", "[when][charsLeftOver]", "[when][nullInput]", "[when][invalidMonth]", "[when][invalidFormat]", "[when][userInvaled]", "[when][iso]" ]
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 6, 2016, 3:58am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326/2 "2016-10-06T03:58:59Z")
I'd normally suggest the prune filter but it unfortunately doesn't support nested fields yet. You'll have to use ruby filter.
---
### Author:  [@Mormaii](https://discuss.elastic.co/u/Mormaii)
#### Post date: [October 6, 2016, 4:02am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326/3 "2016-10-06T04:02:46Z")
Would you mind letting me know how to do this? I'm not really experienced in ruby to do it myself
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 6, 2016, 5:33am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326/4 "2016-10-06T05:33:19Z")
This example is fairly close to what you want: [Remove a field that starts with an integer](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370/11)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326/5 "2017-07-06T04:35:30Z")