# Rsyslog input : Any way to disable severity and severity label? **URL:** \ **Category:** Logstash\ **Created:** [February 22, 2020, 10:35am UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480 "2020-02-22T10:35:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\ **Post date:** [February 22, 2020, 10:35am UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/1 "2020-02-22T10:35:16Z")
Hello guys, I noticed that some logs I collect have a field "severity" (ips logs). This is in conflict with the field "severity" which is related to my syslog input : severity of syslog is long and severity of ips logs is string (i.e "high"). This way, my ips log can't be indexed I didn't found a way to disable all fields related to sysog input : severity, severity label, facility and facility label. Do you know a way to achieve this ? (or a workaround) Thank you ! 🙂 ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [February 22, 2020, 2:55pm UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/2 "2020-02-22T14:55:59Z")
Remove or rename the offending fields in the filter section. If renaming fields, consider ECS naming standards 🙂 ---
**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\ **Post date:** [February 22, 2020, 6:46pm UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/3 "2020-02-22T18:46:01Z")
Hey @rugenl ! As syslog severity field and my ips severity log field have the same name, don't you think all will be removed ? How logstash could make the difference ? ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [February 22, 2020, 6:58pm UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/4 "2020-02-22T18:58:23Z")
Are you sending them to the same input? Same pipeline? Use separate pipelines to process different logs, with appropriate filters for each. ---
**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\ **Post date:** [February 22, 2020, 8:51pm UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/5 "2020-02-22T20:51:14Z")
I've got a dedicated pipeline for these logs. If I remove fields, for example, "severity" and "severity\_label" which are produced by syslog input, how logstash will know that he don't have to remove the field "severity" which is produced by ips logs (the message) ? ---
**Author:** ![Travis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/travis/32/54079_2.png) [@Travis](https://discuss.elastic.co/u/Travis)\ **Post date:** [February 24, 2020, 4:06pm UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/6 "2020-02-24T16:06:29Z")
Solved by removing syslog fields "severity" and "severity\_label" before the kv filter 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 23, 2020, 4:06pm UTC](https://discuss.elastic.co/t/rsyslog-input-any-way-to-disable-severity-and-severity-label/220480/7 "2020-03-23T16:06:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.