CODEWITHSUNDEEP
elasticsearchlogstash
Hyder B.
Hyder B.

Reputation: 12216

Remove unnecessary fields in ElasticSearch

We are populating Elasticsearch via logstash. The thing is that I see some unnecessary fields that I had like to remove like for example:

@version
file
geoip
host
message
offset
tags

Is it possible to do this by defining/extending a dynamic template? If yes, how? If no, can we do this via logstash configuration?

Your help is much appreciated.

Upvotes: 1

Views: 1983

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

You can remove fields using really any logstash filter - when the filter succeeds, it will remove the field.

It makes sense to me to use mutate:

filter {
    mutate {
        remove_field => [ "file" ]
    }
}

That said, most of these fields are incredibly useful and really should not be removed.

Upvotes: 4

Related Questions