Remove header fields generated by http input plugin


When I use http input, Logstash adds the following fields to Elasticsearch:

  • headers.http_accept
  • headers.content_type
  • headers.request_path
  • headers.http_version
  • headers.request_method
  • headers.http_host:localhost
  • headers.request_uri
  • headers.content_length
  • headers.http_user_agent

How can I remove all these fields starting with headers.?

1 Like


This filter should remove them all. I am using similar filter to remove beats input specific fields.

mutate {
    remove_field => ["headers"]

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.