# Remove\_field with regex as argument
**URL:** https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001
**Category:** Logstash
**Created:** [May 31, 2018, 8:37am UTC](https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001 "2018-05-31T08:37:43Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [May 31, 2018, 8:37am UTC](https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001/1 "2018-05-31T08:37:43Z")
I'd like to remove all fields that begin by "foobar". Is there any way to pass a regex to the `remove_field` command, or is there any remove command that accepts regexs?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 31, 2018, 9:39am UTC](https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001/2 "2018-05-31T09:39:42Z")
Use a prune filter.
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [May 31, 2018, 2:38pm UTC](https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001/3 "2018-05-31T14:38:49Z")
Unfortunately the field is a subfield (obtained parsing a JSON), and the `prune` filter doesn't support that.
I thought about using the `mutate` filter to rename the subfield as a root field, but the rename command doesn't allow regexs, so I'm back to square one. Any other ideas?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 31, 2018, 2:58pm UTC](https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001/4 "2018-05-31T14:58:33Z")
Then you'll have to use a ruby filter. I'm pretty sure examples have been posted in the past.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 28, 2018, 3:04pm UTC](https://discuss.elastic.co/t/remove-field-with-regex-as-argument/134001/6 "2018-06-28T15:04:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.