# Unable to remove field form nested object during mutate

**URL:** <https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083>\
**Category:** Logstash\
**Created:** [November 7, 2015, 5:11pm UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083 "2015-11-07T17:11:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ramdev\_Wudali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramdev_wudali/32/7894_2.png) [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\
**Post date:** [November 7, 2015, 5:11pm UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083/1 "2015-11-07T17:11:55Z")

</div>

Hi:  
I am using logstash 1.5.3 and trying to reindex an existing index to a new index with modified mapping. To test if this works on nested fields, I gave the following config a shot :

```
input {
   elasticsearch {
     hosts => ["localhost"]
     port => "9200"
     index => "index1"
     scroll => "5m"
     docinfo => true
   }
}

filter {
  mutate {
    remove_field => ["@timestamp","@version","[entities][kb]"]
  }
}

output {
   elasticsearch {
     host => "localhost"
     port => 9300
     protocol => "transport"
     cluster => "CTRCT-AB8"
     index => "index_mod"
     document_type => "entities2"
     document_id => "%{[@metadata][_id]}"
   }

```

Where entities is a nested field and kb is a nested field within. However, this approach is not removing the field.  
What ends up happening is the new mapping is created where the nested field is no longer a nested field (not a problem) and the field still exists (big problem). I am able to get rid of the top level nested field ("entities") but not any sub fields or sub nested fields of "entities"

I think the syntax for accessing/mutating/modifying nested fields is right (various posts have alluded to documentation, but I cannot find documentation regarding how to specify nested fields). Any help in this regards is very much appreciated.

Thanks much

Ramdev

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 8, 2015, 8:31pm UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083/2 "2015-11-08T20:31:26Z")

</div>

I'm not able to reproduce what you're describing, or I'm not understanding what the problem is.

```
$ cat test.config
input { stdin { codec => json } }
output { stdout { codec => rubydebug } }
filter {
  mutate {
    remove_field => ["@timestamp","@version","[entities][kb]"]
  }
}
$ echo '{"message": "test", "entities": {"kb": "foo"} }' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
     "message" => "test",
    "entities" => {},
        "host" => "hallonet"
}
Logstash shutdown completed
```

---

<div class="post-metadata">

**Author:** ![Ramdev\_Wudali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ramdev_wudali/32/7894_2.png) [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\
**Post date:** [November 8, 2015, 10:13pm UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083/3 "2015-11-08T22:13:27Z")

</div>

Hi Magnus:  
Thanks for the response. What I have found is in my index, I have a nested field which in turn has a nested field. I wanted to promote the inner nested field to the top level (so as to flatten the structure out). So Iwas using mutate to remove the inner nested field and add it back as a top level field.

However, I was unable to do so on the field as it was defined. When I created the following config:

```
input {
   elasticsearch {
     hosts => ["localhost"]
     port => "9200"
     index => "index"
     scroll => "5m"
     docinfo => true
   }
}

filter {
  mutate {
    rename => {"[entities]" => "[mentions_toplevel]"}
    add_field => {
        "[extracted_mentions][stop]" => "[mentions_toplevel][mentions][stop]"
        "[extracted_mentions][start]" => "[mentions_toplevel][mentions][start]"
        "[extracted_mentions][tag]" => "[mentions_toplevel][mentions][tag]"
        "[extracted_mentions][position_category]" => "[mentions_toplevel][mentions][position_category]"
    }
    remove_field => ["@timestamp","@version","[mentions_toplevel][mentions]"]
  }
}

output {
   elasticsearch {
     host => "localhost"
     port => 9300
     protocol => "transport"
     cluster => "cluster"
     index => "index_mod"
     document_type => "entities2"
     document_id => "%{[@metadata][_id]}"
   }
   stdout {
     codec => "dots"
   }
}

```

I was able to get the desired effect. For some reason I am unable to remove the inner nested field from the original field definition.

Thanks

Ramdev

---

<div class="post-metadata">

**Author:** ![kosfar](https://avatars.discourse-cdn.com/v4/letter/k/edb3f5/32.png) [@kosfar](https://discuss.elastic.co/u/kosfar)\
**Post date:** [November 20, 2015, 7:34am UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083/4 "2015-11-20T07:34:56Z")

</div>

Hi,  
I think that your case is related to:

> <https://github.com/logstash-plugins/logstash-filter-mutate/issues/36>

Maybe you would like to upgrade to 1.5.5 and give it another try.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083/5 "2017-07-06T05:22:01Z")

</div>