# Removing fields from logstash

**URL:** <https://discuss.elastic.co/t/removing-fields-from-logstash/341782>\
**Category:** Logstash\
**Created:** [August 28, 2023, 7:16am UTC](https://discuss.elastic.co/t/removing-fields-from-logstash/341782 "2023-08-28T07:16:58Z")\
**Posts on this page:** 1\
**Showing post:** 20

<div class="post-metadata">

**Author:** ![chouben](https://avatars.discourse-cdn.com/v4/letter/c/e495f1/32.png) [@chouben](https://discuss.elastic.co/u/chouben)\
**Post date:** [August 30, 2023, 11:17am UTC](https://discuss.elastic.co/t/removing-fields-from-logstash/341782/20 "2023-08-30T11:17:23Z")

</div>

My processor for one of my Filebeat instances looks like:

```auto
- type: log
  processors:
    - dissect:
        #2021-12-08T08:34:04.370+0100 INFO [monitoring] log/log.go:144 Non-zero metrics in the last 30s {"monitoring": {"metrics
        #datatype: string to integer, long, float, double, boolean or ip
        tokenizer: "%{date}\t%{event.type}\t%{class}\t%{script}\t%{messageCut}"
        field: "message"
        target_prefix: ""
    - timestamp:
        field: date
        layouts:
          - '2006-01-02T15:04:05.999Z07:00'
          - '2006-01-02T15:04:05.999Z0700'
          - '2006-01-02T15:04:05.999999999Z07:00'
          #- '2006-01-02T15:04:05.999-07:00'
        test:
          - '2021-12-08T08:34:04.370+0100'
    - drop_fields:
        fields: ["date", "class", "script", "message"]
    - rename:
        fields:
          - from: "messageCut"
            to: "message"
          
  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/data/log/heartbeat/heartbeat.log
  fields:
    service.type: heartbeat
    event.module: heartbeat
    event.dataset: heartbeat.beat
  fields_under_root: true

```

We mostly do processing in logstash, which was built for this purpose.  
You could easily add a different processor in filebeat to add fields.

---

_[View the full topic](https://discuss.elastic.co/t/removing-fields-from-logstash/341782)._