# Removing fields from logstash

**URL:** <https://discuss.elastic.co/t/removing-fields-from-logstash/341782>\
**Category:** Logstash\
**Created:** [August 28, 2023, 7:16am UTC](https://discuss.elastic.co/t/removing-fields-from-logstash/341782 "2023-08-28T07:16:58Z")\
**Posts on this page:** 1\
**Showing post:** 31

<div class="post-metadata">

**Author:** ![chouben](https://avatars.discourse-cdn.com/v4/letter/c/e495f1/32.png) [@chouben](https://discuss.elastic.co/u/chouben)\
**Post date:** [September 5, 2023, 6:52am UTC](https://discuss.elastic.co/t/removing-fields-from-logstash/341782/31 "2023-09-05T06:52:44Z")

</div>

You are on the right way:

- Split the logline with [grok](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)  
You can test your grok via [the tester in Kibana](https://www.elastic.co/guide/en/kibana/current/xpack-grokdebugger.html)
- Parse the [json message](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) you get via grok splitting

You can operate on the fields you get afterwards..

PS: Logstash is a dedicated product for logs ingestion and way easier to operate than the elasticsearch ingestion pipelines. So I discourage the suggestion from [Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli).

---

_[View the full topic](https://discuss.elastic.co/t/removing-fields-from-logstash/341782)._