# Whitelist nested field
**URL:** https://discuss.elastic.co/t/whitelist-nested-field/317773
**Category:** Logstash
**Created:** [October 31, 2022, 3:39am UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773 "2022-10-31T03:39:09Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@yuswanul](https://discuss.elastic.co/u/yuswanul)
#### Post date: [October 31, 2022, 3:39am UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/1 "2022-10-31T03:39:09Z")
Hi everyone,
i plan to whitelist some fields, but they are nested field. i already tried prune to whitelist them and it didn't work. for example:
> Request Body : {"tipe":"FF","nama":"ABC","nik":"","handphone":"00012","email":"","channelId":"7777","clientId":"1234"}
if i want to whitelist only channelId and clientId, how do i do that? Thanks
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 31, 2022, 6:33am UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/2 "2022-10-31T06:33:28Z")
How does it look in LS?
If is nested like:
"Request Body" : {"tipe":"FF","nama":"ABC","nik":"","handphone":"00012","email":"","channelId":"7777","clientId":"1234"}
then should be like this:
["Request Body"]["tipe"]
["Request Body"]["nama"]
...
If are not nested, then is simple just "tipe"
---
### Author:  [@yuswanul](https://discuss.elastic.co/u/yuswanul)
#### Post date: [October 31, 2022, 6:50am UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/3 "2022-10-31T06:50:42Z")
oh, sorry i forget to tell you that i have a json filter like this:
> json{
> source =\> "requestBody"
> target =\> "requestBody"
> skip\_on\_invalid\_json =\> true
> }
i tried using prune like this before but it didn't work:
`[requestBody][channelId], [requestBody][clientId]`
is "" inside the bracket will take effect?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 31, 2022, 6:55am UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/4 "2022-10-31T06:55:59Z")
Should be like this: [requestBody][channelId]
If is still not working, check in ruby debugger, you might have an array like this [requestBody][0][channelId]
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 31, 2022, 4:46pm UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/5 "2022-10-31T16:46:00Z")
> [@yuswanul](#):
>
> i tried using prune like this before but it didn't work:
> `[requestBody][channelId], [requestBody][clientId]`
A prune filter only operates on top-level fields, it cannot whitelist or blacklist nested fields.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 31, 2022, 4:53pm UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/6 "2022-10-31T16:53:07Z")
As workaround, then you can copy white list fields in another fields, and remove requestBody
` mutate { remove_field => ["requestBody"] }`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 28, 2022, 4:54pm UTC](https://discuss.elastic.co/t/whitelist-nested-field/317773/7 "2022-11-28T16:54:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.