# \[SOLVED\] Drop filter issue

**URL:** https://discuss.elastic.co/t/solved-drop-filter-issue/54944
**Category:** Logstash
**Created:** [July 7, 2016, 12:23pm UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944 "2016-07-07T12:23:54Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [July 7, 2016, 12:23pm UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944/1 "2016-07-07T12:23:54Z")

</div>

Hi all,

I try to drop the field "message" in logstash:

> ```
> filter {
> if [type] == "test" {
> grok {
> match => {"message" => "%{TIMESTAMP_ISO8601:syslog_host_time} %{IP:client} %{WORD:severity} %{DATESTAMP_IOS:client_date}\: \%%{FACILITY_WORD:facility}-%{POSINT:int_severity}-%{WORD:mnemonic}: %{GREEDYDATA:short_message}"}
> add_tag => ["test"]
> match => { "path" => "%{YEAR:log_year}" }
> }
> mutate {
> add_field => { "@source" => "%{client}" }
> }
> dns {
> nameserver => "127.0.0.1"
> reverse => ["@source"]
> action => "replace"
> }
> date {
> timezone => "Europe/Paris"
> match => [ "client_date", "YYYY MMM dd HH:mm:ss z", "YYYY MMM dd HH:mm:ss.SSS 'CET'", "YYYY MMM dd HH:mm:ss.SSS 'CEST'", "Y
> }
> drop {
> remove_field => ["message"]
> }
> }
> }
> 
> ```

But my problem is when I try that I have no more logs.

Do you know why ?

But it works when I remove the drop filter and I try with mutate filter like:

> ```
> mutate {
> add_field => { "@source" => "%{client}" }
> remove_field => ["message"]`
> }
> 
> ```

Thanks in advance for your answers,  
Alex

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 7, 2016, 12:47pm UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944/2 "2016-07-07T12:47:45Z")

</div>

The drop filter drops whole events, not individual fields of events. Replace drop with mutate.

---

<div class="post-metadata">

### Author: ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [July 7, 2016, 1:04pm UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944/3 "2016-07-07T13:04:44Z")

</div>

Thanks for your quick answer !

The behavior looks like you said, but I'm abit confused when I read the documentation:

> ```
> Drop filter
> 
> - remove_field
> 
> ```

> ```
> . Value type is array
> . Default value is [] 
> 
> ```

> ```
> If this filter is successful, remove arbitrary fields from this event.
> 
> ```

What is the purpose of remove a specific field if the whole event is drop ?

Have a good day,  
Alex

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 7, 2016, 1:38pm UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944/4 "2016-07-07T13:38:25Z")

</div>

Some options like `add_field` and `remove_field` apply to all filters even though they might not always make sense.

---

<div class="post-metadata">

### Author: ![axelfelix](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [July 7, 2016, 1:51pm UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944/5 "2016-07-07T13:51:24Z")

</div>

Thanks !

Have a good day,  
Alex

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/solved-drop-filter-issue/54944/6 "2017-07-06T04:49:07Z")

</div>