# \[SOLVED\]Prune Filter Question

**URL:** <https://discuss.elastic.co/t/solved-prune-filter-question/193108>\
**Category:** Logstash\
**Created:** [July 31, 2019, 11:50am UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108 "2019-07-31T11:50:17Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [July 31, 2019, 11:50am UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/1 "2019-07-31T11:50:17Z")

</div>

Hi,

I want to prune my logs and only take some fields.  
Here is my logstash config file but this config didnt work. How can solve this issue?

```
input {
  beats {
    port => 5044
  }
}

filter {
    json {
        source => "message"
        remove_field => "message"
    }

    prune {
        whitelist_names => ["layers.ip.ip_ip_src_host"]
        #"[layers][ip][ip_ip_src_host]"
    }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "webserver01-%{+YYYY-MM-dd}"
    document_type => "pcap_file"
    manage_template => false
  }
}

```

My Json Object:

> **[Test](https://jsonformatter.org/json-parser/07bd07)**
>
> Prune Example

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 31, 2019, 12:11pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/2 "2019-07-31T12:11:56Z")

</div>

> [@kolten](#):
>
> whitelist\_names =\> ["layers.ip.ip\_ip\_src\_host"]

Your data does not have dots in the field names, it has fields that contain objects. So you should be refering to [layers][ip][ip\_ip\_src\_host]

---

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [July 31, 2019, 12:22pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/3 "2019-07-31T12:22:53Z")

</div>

I referred like commented line

[layers][ip][ip\_ip\_src\_host]

it doesnt work

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 31, 2019, 12:34pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/4 "2019-07-31T12:34:13Z")

</div>

From the documentation...

This filter currently only support operations on top-level fields, i.e. whitelisting and blacklisting of subfields based on name or value does not work.

---

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [July 31, 2019, 12:38pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/5 "2019-07-31T12:38:12Z")

</div>

thanks @Badger Do you know how can i move to top level?

---

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [July 31, 2019, 12:52pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/6 "2019-07-31T12:52:25Z")

</div>

I tried ruby code event.get and event.set but it doesnt work. Can you help me for write this code?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 31, 2019, 1:07pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/7 "2019-07-31T13:07:25Z")

</div>

If you really just want the one field then

```
    prune { whitelist_names => ["^layers"] }
    mutate { add_field => { "ip_src_host" => "%{[layers][ip][ip_ip_src_host]}" } }
    mutate { remove_field => ["layers"] }
```

---

<div class="post-metadata">

**Author:** ![kolten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kolten/32/35725_2.png) [@kolten](https://discuss.elastic.co/u/kolten)\
**Post date:** [July 31, 2019, 1:36pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/8 "2019-07-31T13:36:50Z")

</div>

Thanks @Badger it worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2019, 1:38pm UTC](https://discuss.elastic.co/t/solved-prune-filter-question/193108/9 "2019-08-28T13:38:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.