# Removing specific fields
**URL:** https://discuss.elastic.co/t/removing-specific-fields/130013
**Category:** Logstash
**Created:** [April 30, 2018, 10:43am UTC](https://discuss.elastic.co/t/removing-specific-fields/130013 "2018-04-30T10:43:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Nikolay\_Petrov](https://discuss.elastic.co/u/Nikolay_Petrov)
#### Post date: [April 30, 2018, 10:43am UTC](https://discuss.elastic.co/t/removing-specific-fields/130013/1 "2018-04-30T10:43:48Z")
Hi,
I'm trying to remove fields like this "\*\_bytes" using logstash filter, without any success so far:
> {
> ...
> "mountpoints": {
> "/soft": {
> "size\_bytes": "21003628544",
> "available\_bytes": "20957556736",
> "used\_bytes": "46071808",
> },
> "/dev/shm": {
> "size\_bytes": "521474048",
> "available\_bytes": "521474048",
> "used\_bytes": "0",
> },
> "/": {
> "size\_bytes": "8319852544",
> "available\_bytes": "5288181760",
> "used\_bytes": "3031670784",
> }
> },
> "disks": {
> "xvdb": {
> "size\_bytes": "21474836480"
> },
> "xvda": {
> "size\_bytes": "8589934592"
> }
> },
> "partitions": {
> "/dev/xvda1": {
> "size\_bytes": "8588886016",
> }
> },
> ...
> }
my logstash logstash filter:
> ...
> ruby {
> code =\> "
> event.to\_hash.keys.each { |k|
> if k.end\_with?('bytes')
> event.remove(k)
> end
> }
> "
> }
>
> ```
> prune {
> interpolate => true
> blacklist_names => ["^.*bytes$", "&{}>;,", "[^.*][.*][.*_bytes$]" ]
> }
>
> mutate {
> remove_field => [".*bytes", "^.*[.*bytes]$" ]
> }
>
> ```
>
> ...
> i'm not sure what i missed into the regexp or any other filter that can be used.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 30, 2018, 6:27pm UTC](https://discuss.elastic.co/t/removing-specific-fields/130013/2 "2018-04-30T18:27:35Z")
The prune filter doesn't work with nested fields ([https://github.com/logstash-plugins/logstash-filter-prune/issues/12](https://github.com/logstash-plugins/logstash-filter-prune/issues/12)) and your ruby snippet only processes the keys at the top level of the event. You'd have to write Ruby code that recurses into the subhashes. I don't have time to provide an example of that, but since it's not a Logstash-specific problem I imagine you'll find a solution at e.g. StackOverflow.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 28, 2018, 6:27pm UTC](https://discuss.elastic.co/t/removing-specific-fields/130013/3 "2018-05-28T18:27:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.