# Remove unused fields from logstash-\* index

**URL:** <https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386>\
**Category:** Elasticsearch\
**Created:** [December 28, 2017, 5:27am UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386 "2017-12-28T05:27:47Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![nnet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nnet/32/25982_2.png) [@nnet](https://discuss.elastic.co/u/nnet)\
**Post date:** [December 28, 2017, 5:27am UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/1 "2017-12-28T05:27:47Z")

</div>

Hi folks, i accidently added winlogbeat event fields to logstash-\* index and want to remove them. I don't have any logstash-\* data using the fields as I deleted those events.

How can I remove the unused fields?

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [December 28, 2017, 7:19am UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/2 "2017-12-28T07:19:32Z")

</div>

use curator can delete as you know.

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [December 28, 2017, 8:18am UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/3 "2017-12-28T08:18:35Z")

</div>

Hi,

This might push you in the right direction.

> <https://stackoverflow.com/questions/29002215/remove-a-field-from-a-elasticsearch-document>

---

<div class="post-metadata">

**Author:** ![nnet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nnet/32/25982_2.png) [@nnet](https://discuss.elastic.co/u/nnet)\
**Post date:** [December 28, 2017, 4:43pm UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/4 "2017-12-28T16:43:01Z")

</div>

@zqc0512 I don't understand your response, can you elaborate?

---

<div class="post-metadata">

**Author:** ![nnet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nnet/32/25982_2.png) [@nnet](https://discuss.elastic.co/u/nnet)\
**Post date:** [December 28, 2017, 4:46pm UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/5 "2017-12-28T16:46:11Z")

</div>

@pjanzen Doesn't this assume there's documents that use the fields I want to delete? I don't have any documents using those fields, I've long ago deleted them.

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [December 28, 2017, 8:30pm UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/6 "2017-12-28T20:30:10Z")

</div>

If the fields are not used you can make a new mapping for a new index and reindex the data to that new index, delete the old index and reindex the data back to the original name.

About the link, there is explained how to removed a used field. More then that I cannot elaborate.

---

<div class="post-metadata">

**Author:** ![zqc0512](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zqc0512/32/32141_2.png) [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Post date:** [December 29, 2017, 12:20am UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/7 "2017-12-29T00:20:58Z")

</div>

update the mapping for new docs, or update the old docs with update api.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 26, 2018, 12:21am UTC](https://discuss.elastic.co/t/remove-unused-fields-from-logstash-index/113386/8 "2018-01-26T00:21:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.