# Removing fields using mutate (JSON)
**URL:** https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144
**Category:** Logstash
**Created:** [September 9, 2016, 9:05am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144 "2016-09-09T09:05:56Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dsever](https://discuss.elastic.co/u/dsever)
#### Post date: [September 9, 2016, 9:05am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144/1 "2016-09-09T09:05:56Z")
Hi,
While parsing some json logs I'm getting into problem with unavailability to remove one subfield,
for instance this is my JSON
"alert": [ { "src": { "url": "xxxx",
"domain": "xxxx",
"smtp-mail-from": "xxxxxxxx"
},
"severity": "xxxx",
"dst": { "smtp-to": "xxxxx"
},
"explanation": {
"protocol": "",
"service": "xxxxxx",
"analysis": "binary",
"os-changes": [ {XXXXXXX
Using
remove\_field =\> ["json","message","[alert][explanation]] i can successfully remove til the field explanation but it cuts to much, so I need to cut it as os-changes as last filed.
But I get stuck into problem that buttom example doesn't cut os-changes
remove\_field =\> ["json","message","[alert][explanation][os-changes]"]
Thanks
Dubravko
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 9, 2016, 9:22am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144/2 "2016-09-09T09:22:34Z")
So you want to remove the `os-changes` subfield? It would be more obvious if you showed us what you want the resulting event to look like.
---
### Author:  [@dsever](https://discuss.elastic.co/u/dsever)
#### Post date: [September 9, 2016, 10:47am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144/3 "2016-09-09T10:47:34Z")
Hi,
Hi just want to remove fileld os-changes
"alert": [ { "src":
{ "url": "xxxx",
"domain": "xxxx",
"smtp-mail-from": "xxxxxxxx"
},
"severity": "xxxx",
"dst": { "smtp-to": "xxxxx"
},
"explanation": {
"protocol": "",
"service": "xxxxxx",
"analysis": "binary",
"os-changes": [{XXXXXXX }] # and want to remove all included in os-changes array, because i contains a lots of data that is only overhead to our system, it should be simple 🙂
}
}
]
I suppose syntax would be
remove\_field =\> ["json","message","[alert][explanation][os-changes]"]
but for some reason it doesn't work, I'm still getting filed os-changes and its subfields.
Dubravko
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 9, 2016, 10:50am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144/4 "2016-09-09T10:50:51Z")
Okay. `alert` is an array so you need `[alert][0][explanation][os-changes]` to access the first element of it
---
### Author:  [@dsever](https://discuss.elastic.co/u/dsever)
#### Post date: [September 9, 2016, 10:56am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144/5 "2016-09-09T10:56:54Z")
So simple 🙂
Thanks, it works
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/removing-fields-using-mutate-json/60144/6 "2017-07-06T04:39:06Z")