# Remove\_Field json path on logstash

**URL:** https://discuss.elastic.co/t/remove-field-json-path-on-logstash/304146
**Category:** Logstash
**Created:** [May 6, 2022, 4:46pm UTC](https://discuss.elastic.co/t/remove-field-json-path-on-logstash/304146 "2022-05-06T16:46:40Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 6, 2022, 5:00pm UTC](https://discuss.elastic.co/t/remove-field-json-path-on-logstash/304146/2 "2022-05-06T17:00:16Z")

</div>

As the documentation says, prune only operates on top-level fields, so you cannot use it on fields inside [response][result].

Your message is not valid JSON. If I change it to be valid then I can do this:

```
input { generator { count => 1 lines => ['{"recode":"VZ##","response-code":"4000","response":{"result":[{"DetailsPageURL":"foo","idsource":"0","Attribute":[{"DISPLAYNAME":"Tiempo de respuesta server oasu","Value":"2305"}]}]}}' ] } }
filter {
    json { source => "message" remove_field => ["message"] }
    mutate {
        add_field => {
            "DISPLAYNAME" => "%{[response][result][0][Attribute][0][DISPLAYNAME]}"
            "Value" => "%{[response][result][0][Attribute][0][Value]}"
        }
        remove_field => ["response"]
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

which produces

```
"response-code" => "4000",
        "Value" => "2305",
       "recode" => "VZ##",
  "DISPLAYNAME" => "Tiempo de respuesta server oasu"

```

You may want to replace the remove\_field with a prune using whitelist\_names.

If you want to keep those two fields in place then you would need a custom ruby filter. [I do not think](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424/2) there is a generic solution to do it that way.

---

_[View the full topic](https://discuss.elastic.co/t/remove-field-json-path-on-logstash/304146)._