# Want to remove some field from GROK filter

**URL:** <https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555>\
**Category:** Logstash\
**Created:** [August 16, 2019, 7:27pm UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555 "2019-08-16T19:27:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumansaha](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sumansaha](https://discuss.elastic.co/u/sumansaha)\
**Post date:** [August 16, 2019, 7:27pm UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555/1 "2019-08-16T19:27:11Z")

</div>

I've this log format:

QID: 13636 from: 127.0.0.1 qtype: A qclass: IN qname: acep.top. rcode: NXDOMAIN rrcount: 0 policy: 'dns-name.host.sum'

I've used this GROK filter :  
%{WORD:qid}: %{NUMBER:id} %{WORD:from}: %{IP:clientip} %{WORD:qtype}: %{WORD:qtans} %{WORD:qcls}: %{WORD:qclst} %{WORD:qname}: %{HOSTNAME:dstdom} %{WORD:rcode}: %{WORD:policyresp} %{WORD:rrcount}: %{NUMBER:rcnum} %{WORD:pol}: %{GREEDYDATA:policyzone}

I've this output:  
{  
"qid": [  
[  
"QID"  
]  
],  
"id": [  
[  
"13636"  
]  
],  
"BASE10NUM": [  
[  
"13636",  
"0"  
]  
],  
"from": [  
[  
"from"  
]  
],  
"clientip": [  
[  
"127.0.0.1"  
]  
],  
"IPV6": [  
[  
null  
]  
],  
"IPV4": [  
[  
"127.0.0.1"  
]  
],  
"qtype": [  
[  
"qtype"  
]  
],  
"qtans": [  
[  
"A"  
]  
],  
"qcls": [  
[  
"qclass"  
]  
],  
"qclst": [  
[  
"IN"  
]  
],  
"qname": [  
[  
"qname"  
]  
],  
"dstdom": [  
[  
"acep.top."  
]  
],  
"rcode": [  
[  
"rcode"  
]  
],  
"policyresp": [  
[  
"NXDOMAIN"  
]  
],  
"rrcount": [  
[  
"rrcount"  
]  
],  
"rcnum": [  
[  
"0"  
]  
],  
"pol": [  
[  
"policy"  
]  
],  
"policyzone": [  
[  
"'dns-name.host.sum'"  
]  
]  
}

I want to remove some fields like qcls , qclst from output.Can anyone help please.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 16, 2019, 7:38pm UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555/2 "2019-08-16T19:38:21Z")

</div>

> [@sumansaha](#):
>
> %{WORD:from}:

You can remove fields from an event using [mutate+remove\_field](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-remove_field). However, if you do not want to capture the value of a pattern then just do not name it, so instead of %{WORD:qcls}: just use %{WORD}:

That said, you appear to be using regular expression to match constants. It would be more efficient to put the constant in the pattern. For example if the message always starts with QID then start your pattern with

```
^QID: %{NUMBER:id}

```

You can read [here](https://www.elastic.co/blog/do-you-grok-grok) about why anchoring that expression with ^ is a good idea.

---

<div class="post-metadata">

**Author:** ![sumansaha](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sumansaha](https://discuss.elastic.co/u/sumansaha)\
**Post date:** [August 18, 2019, 9:39am UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555/3 "2019-08-18T09:39:37Z")

</div>

Many Thanks.

---

<div class="post-metadata">

**Author:** ![sumansaha](https://avatars.discourse-cdn.com/v4/letter/s/9f8e36/32.png) [@sumansaha](https://discuss.elastic.co/u/sumansaha)\
**Post date:** [August 18, 2019, 9:42am UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555/4 "2019-08-18T09:42:10Z")

</div>

> [@sumansaha](#):
>
> 'dns-name.host.sum'

I want to discard the inverted comma from %{GREEDYDATA:policyzone}.

"policyzone": [  
[  
"'dns-name.host.sum'"  
]  
]

Now output coming with inverted comma,How I can remove that.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 18, 2019, 11:37am UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555/5 "2019-08-18T11:37:25Z")

</div>

```
mutate { gsub => ["policyzone", "'", ""] }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2019, 11:37am UTC](https://discuss.elastic.co/t/want-to-remove-some-field-from-grok-filter/195555/6 "2019-09-15T11:37:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.