# Remove the values/fields from Logstash

**URL:** <https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711>\
**Category:** Logstash\
**Created:** [March 11, 2025, 2:16pm UTC](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711 "2025-03-11T14:16:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gowtham1](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\
**Post date:** [March 11, 2025, 2:16pm UTC](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711/1 "2025-03-11T14:16:10Z")

</div>

Hi,

I want to remove this values %{[@METADATA][HOST][1]} from the field named "FLOOR" . Please see the below Logstash pipeline config.

We have split the fields and then the field name %{[@METADATA][HOST][1]} coming as a value. Please suggest what needs to be done.

mutate  
{  
add\_field =\> { "[@metadata][host]" =\> "%{[AP\_NAME]}" }  
}  
mutate  
{  
split =\> { "[@metadata][host]" =\> "-" }  
add\_field =\> {  
"FLOOR" =\> "%{[@metadata][host][1]}"  
}  
}

Regards  
Gowtham S

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 11, 2025, 2:31pm UTC](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711/2 "2025-03-11T14:31:10Z")

</div>

If you are saying that the mutate+add\_field is adding the literal value "%{[@metadata][host][1]}" when the field [@metadata][host][1] does not exist then that is expected. You can avoid it by testing whether the field exists

```
mutate { split => { "[@metadata][host]" => "-" } }
if [@metadata][host][1] { mutate { add_field => { "FLOOR" => "%{[@metadata] [host][1]}" } }

```

---

<div class="post-metadata">

**Author:** ![Gowtham1](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\
**Post date:** [March 11, 2025, 2:57pm UTC](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711/3 "2025-03-11T14:57:37Z")

</div>

Thanks for your prompt response will check and update the status

---

<div class="post-metadata">

**Author:** ![Gowtham1](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\
**Post date:** [March 11, 2025, 6:28pm UTC](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711/4 "2025-03-11T18:28:26Z")

</div>

> [@Badger](#):
>
> `mutate { split => { "[@metadata][host]" => "-" } }`

PR build got passed once it's approved and merged will let you know the status.