# Remove Specific Field matching pattern

**URL:** https://discuss.elastic.co/t/remove-specific-field-matching-pattern/328260
**Category:** Logstash
**Created:** [March 22, 2023, 2:44pm UTC](https://discuss.elastic.co/t/remove-specific-field-matching-pattern/328260 "2023-03-22T14:44:31Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 22, 2023, 4:36pm UTC](https://discuss.elastic.co/t/remove-specific-field-matching-pattern/328260/2 "2023-03-22T16:36:35Z")

</div>

```auto
if "[response][body][entries][values]" == '^n1D.*' { drop { } }

```

This will not work because it is checking if the field value is exactly equal to that string, it is not a regexp match (which would be =~ instead of ==) and it is testing the field value, not the field name.

```auto
ruby {
    code => "
        event.to_hash.keys.each { |k|
            if k.start_with?('n1D')
                event.remove(k)
            end
        }
    "
}

```

This does not work because it only tests the top-level fields (e.g [response] in your example). If you just need to do this for that one field you could try

```
ruby {
    code => '
        v = event.get("[response][body][entries][values]")
        if v.is_a? Hash
            v.to_hash.keys.each { |k|
                if k.start_with?("n1D")
                    event.remove(k)
                end
            }
        end
   '
}

```

If you need to recursively process all fields of an event then see [this](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248/8) thread.

---

_[View the full topic](https://discuss.elastic.co/t/remove-specific-field-matching-pattern/328260)._