# Removing fields from Index

**URL:** <https://discuss.elastic.co/t/removing-fields-from-index/301623>\
**Category:** Beats\
**Tags:** windows\
**Created:** [April 5, 2022, 11:15am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623 "2022-04-05T11:15:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)\
**Post date:** [April 5, 2022, 11:15am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623/1 "2022-04-05T11:15:59Z")

</div>

Hi sorry for bothering you everytime.

I upload some logs into elastic via filebeat, but there is some other information added to my original logs like the host name os kernel ..., and the main message become unformatted, i want to delete all the field that are unnecessary and only keep my original message in the initial form.

---

<div class="post-metadata">

**Author:** ![Bndlr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bndlr/32/94658_2.png) [@Bndlr](https://discuss.elastic.co/u/Bndlr)\
**Post date:** [April 6, 2022, 11:15am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623/2 "2022-04-06T11:15:36Z")

</div>

> [@The-morpho](#):
>
> ilebeat, but there is some other information added to my original logs like the host name os kernel ..., and the main message become unformatted, i want to

You can delete Fields in the Filebeat processor like

```auto
processors:
  - drop_fields:
      fields: ["agent", "log", "input", "host", "ecs"]

```

Or, if you don't need the Host information in generally, you can remove this from your filebeat conf.

` - add_host_metadata: ~`

from Filebeat Configuration.

---

<div class="post-metadata">

**Author:** ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)\
**Post date:** [April 7, 2022, 9:24am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623/3 "2022-04-07T09:24:50Z")

</div>

Thank you @Bndlr I'm gonna try it and reply back

---

<div class="post-metadata">

**Author:** ![The-morpho](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@The-morpho](https://discuss.elastic.co/u/The-morpho)\
**Post date:** [April 7, 2022, 12:55pm UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623/4 "2022-04-07T12:55:14Z")

</div>

hey @Bndlr i just try to delete `add_host_metadata:` from filebeat.yml but the host info still there in elastic.

I'm new with elk, so i don't know where write this code

```auto
processors:
  - drop_fields:
      fields: ["agent", "log", "input", "host", "ecs"]

```

---

<div class="post-metadata">

**Author:** ![Bndlr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bndlr/32/94658_2.png) [@Bndlr](https://discuss.elastic.co/u/Bndlr)\
**Post date:** [April 8, 2022, 5:56am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623/5 "2022-04-08T05:56:17Z")

</div>

Hey,

you have to change the following Block in your filebeat.yml if you don't want to get any Host Information at the log lines

```auto
processors:
  - add_docker_metadata:
  # - add_host_metadata: ~

```

( -add\_host\_metadata\_~ is commented out)

If you only want to remove special fields you have to add the the following to the proccessors Block in your filebeat.yml

```auto
processors:
  - drop_fields:
      fields: ["host.name", "ecs.version", "agent.version", "agent.type", "agent.id",]

```

Check also this out -\> [How to remove certain fields from filebeat index](https://discuss.elastic.co/t/how-to-remove-certain-fields-from-filebeat-index/241597)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2022, 5:56am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623/6 "2022-05-06T05:56:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.