Remove processor
editRemove processor
editRemoves existing fields. If one field doesn’t exist, an exception will be thrown.
Table 36. Remove Options
Name | Required | Default | Description |
---|---|---|---|
|
yes |
- |
Fields to be removed. Supports template snippets. |
|
no |
|
If |
|
no |
- |
Fields to be kept. When set, all fields other than those specified are removed. |
|
no |
- |
Description of the processor. Useful for describing the purpose of the processor or its configuration. |
|
no |
- |
Conditionally execute the processor. See Conditionally run a processor. |
|
no |
|
Ignore failures for the processor. See Handling pipeline failures. |
|
no |
- |
Handle failures for the processor. See Handling pipeline failures. |
|
no |
- |
Identifier for the processor. Useful for debugging and metrics. |
Here is an example to remove a single field:
{ "remove": { "field": "user_agent" } }
To remove multiple fields, you can use the following query:
{ "remove": { "field": ["user_agent", "url"] } }
You can also choose to remove all fields other than a specified list:
{ "remove": { "keep": ["url"] } }