# Script processor for retaning relevant fields not working

**URL:** <https://discuss.elastic.co/t/script-processor-for-retaning-relevant-fields-not-working/348320>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [November 30, 2023, 10:30am UTC](https://discuss.elastic.co/t/script-processor-for-retaning-relevant-fields-not-working/348320 "2023-11-30T10:30:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vishnuhngama](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishnuhngama/32/121579_2.png) [@vishnuhngama](https://discuss.elastic.co/u/vishnuhngama)\
**Post date:** [November 30, 2023, 10:30am UTC](https://discuss.elastic.co/t/script-processor-for-retaning-relevant-fields-not-working/348320/1 "2023-11-30T10:30:59Z")

</div>

I am writing a script processor which will retain only the relevant fields and remove all the other fields . Here 'message','custom\_field','@timestamp','\_index','\_id','\_version','index\_name','tags', is getting retained but the fields like 'audit.log.0','audit.log.1','event.type','auditd.log.key','event.dataset','event.created','event.original','event.ingested' is not getting retained .

Please provide me a solution . Also i dont want to use remove processor and logstash , I want to handle this using ingest pipeline only since I am using filebeats audit ingest pipeline for parsing the events

```auto
{
      "script": {
        "source": """
      
       ctx.keySet().retainAll(['message','custom_field','@timestamp','_index','_id','_version','index_name','tags','audit.log.0','audit.log.1','event.type','auditd.log.key','event.dataset','event.created','event.original','event.ingested'])
      
        """
      }
    }

```

---

<div class="post-metadata">

**Author:** ![vishnuhngama](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishnuhngama/32/121579_2.png) [@vishnuhngama](https://discuss.elastic.co/u/vishnuhngama)\
**Post date:** [December 13, 2023, 1:35pm UTC](https://discuss.elastic.co/t/script-processor-for-retaning-relevant-fields-not-working/348320/2 "2023-12-13T13:35:10Z")

</div>

Reply guys

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2024, 1:35pm UTC](https://discuss.elastic.co/t/script-processor-for-retaning-relevant-fields-not-working/348320/3 "2024-01-10T13:35:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.