# Remove fields with specific prefix at the end of LogStash pipeline

**URL:** <https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911>\
**Category:** Logstash\
**Created:** [August 19, 2021, 6:53am UTC](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911 "2021-08-19T06:53:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![itokai](https://avatars.discourse-cdn.com/v4/letter/i/db5fbb/32.png) [@itokai](https://discuss.elastic.co/u/itokai)\
**Post date:** [August 19, 2021, 6:53am UTC](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911/1 "2021-08-19T06:53:33Z")

</div>

Hello,

how to remove children fields with specific prefix at the end of LogStash pipeline?

```auto
parent.level2.level3.removewiththisprefix_1, parent.level2.level3.removewiththisprefix_2,... parent.level2.level3.removewiththisprefix_X

```

Have tried with [Mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html) but it doesn't recognize regexp

```auto
filter {
      mutate {
        remove_field => ["parent.level2.level3.removewiththisprefix_*", "removewiththisprefix_*"]
      }
    }

```

and also with custom _ruby_ block, but what path to use in order to reach children?

```auto
ruby {
    code => '
        event.to_hash.each { |k, v|
           if event.get(k).start_with?("removewiththisprefix_")
               event.remove(k)
           end
        }
        '
    }

```

Suffixes of those fields are unpredictable, that's why need to rely on prefix. Their amount can be big, so they have to go away before writing document to index. Any steady suggestion is welcome!

Regards

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 19, 2021, 1:23pm UTC](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911/2 "2021-08-19T13:23:49Z")

</div>

See [this](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248) thread.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2021, 1:24pm UTC](https://discuss.elastic.co/t/remove-fields-with-specific-prefix-at-the-end-of-logstash-pipeline/281911/3 "2021-09-16T13:24:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.