The processors only filter part of message

[Augustus1995 (duyucong)]

Hi, i want to use filebeat send message to elasticsearch directly. And i use processors as a filter to drop some useless fields. But when i check message from kibana only half messages drop fields. And i only run one filebeat. so is there have some solutions to let all messages drop fields.

here is my filebeat.yml

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - h:\log\*
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
output.elasticsearch:
  hosts: ["localhost:9200"]
processors:
- drop_fields:
    fields: ["offset", "_score", "_version","beat"]

And the pic of my kibana:

what's more, can i decode the json in the "message"?
i have try- decode_json_fields: but it didn't work

[Christian_Dahlqvist]

_score and _version are internal Elasticsearch fields, so do not exist in Filebeat and can not be dropped.

[Augustus1995 (duyucong)]

@Christian_Dahlqvist

o not exist in Filebeat and can not be

but what about offset and beat it is in the _source and why in some message i could drop it but the other not

[steffens (Steffen Siering)]

How many filebeat instances have you running? Can you not exclude the beat field?