# Send only some fields of processor 'add\_host\_metadata'

**URL:** <https://discuss.elastic.co/t/send-only-some-fields-of-processor-add-host-metadata/227778>\
**Category:** Beats\
**Created:** [April 13, 2020, 1:32pm UTC](https://discuss.elastic.co/t/send-only-some-fields-of-processor-add-host-metadata/227778 "2020-04-13T13:32:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![felixbarbeira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixbarbeira/32/63637_2.png) [@felixbarbeira](https://discuss.elastic.co/u/felixbarbeira)\
**Post date:** [April 13, 2020, 1:32pm UTC](https://discuss.elastic.co/t/send-only-some-fields-of-processor-add-host-metadata/227778/1 "2020-04-13T13:32:49Z")

</div>

I'm using filebeat and I only need a couple of fields from the processor "[add\_host\_metadata](https://www.elastic.co/guide/en/beats/filebeat/current/add-host-metadata.html)". The only way I found to send those events is the following:

```auto
processors:
  - add_host_metadata: ~

```

And then on Elasticsearch ingest pipeline remove all the fields:

```auto
"remove": {
  "field": [
    "host.architecture",
    "host.containerized",
    "host.id",
    "host.os.name",
    "host.os.family",
    "host.os.version",
    "host.os.kernel"
  ]
}

```

It would be perfect if exist some way to send from filebeat _only_ the fields I want, somebody knows if is this possible?

---

<div class="post-metadata">

**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\
**Post date:** [April 13, 2020, 5:27pm UTC](https://discuss.elastic.co/t/send-only-some-fields-of-processor-add-host-metadata/227778/2 "2020-04-13T17:27:05Z")

</div>

Try using the [`drop_fields`](https://www.elastic.co/guide/en/beats/filebeat/master/drop-fields.html) processor:

```auto
processors:
- add_host_metadata: ~
- drop_fields:
    fields: ["host.architecture", "host.containerized", "host.id", "host.os.name", "host.os.family", "host.os.version", "host.os.kernel"]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2020, 7:27pm UTC](https://discuss.elastic.co/t/send-only-some-fields-of-processor-add-host-metadata/227778/3 "2020-05-11T19:27:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.