Remove selected fields or keep an allowlist in Logstash

Use mutate to delete known fields. If an event contains many unwanted fields and only a few should survive, the prune filter provides a top-level allowlist.

Delete several named fields

filter {
  mutate {
    remove_field => ["message", "path", "host"]
  }
}

Check the event structure before applying this example. With ECS enabled, the file path is usually [log][file][path]; removing top-level path will not remove it. Removing host removes that entire field, including a nested host object if one exists.

Keep only selected top-level fields

Install the prune plugin if it is not included in your deployment. Its name filters are regular expressions, so anchor each name:

filter {
  prune {
    whitelist_names => [
      "^@timestamp$", "^level$", "^service$",
      "^trace_id$", "^duration$", "^tags$"
    ]
  }
}

Keeping tags preserves routing and failure markers. Add other fields your outputs require before enabling this policy. Prune's name filtering operates on top-level fields; use bracket references with mutate for selected nested fields.

Remove a field only for selected events

filter {
  if [level] == "DEBUG" {
    mutate { remove_field => ["message"] }
  }
}

Mutate and prune can appear in the same filter chain, but later stages see the result of earlier ones. Validate the full sequence with representative events before sending them to your normal output.

Removal changes the current event, so subsequent Elasticsearch outputs do not receive the deleted field. It does not remove data already indexed, queued elsewhere, or saved by a previous stage. A codec that merely excludes a field from one serialized output is a different policy from deleting it in the filter chain.

@metadata is normally excluded from output serialization regardless of this cleanup. It remains available for routing unless your configuration explicitly removes or changes it. For Beats events, inspect the actual field paths rather than assuming every copy of the original log is named message.

References

• Elastic: filters prune
• Elastic: filters mutate
• Elastic: event dependent configuration