{"action":"created","issue":{"url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/218","labels_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/218/labels{/name}","comments_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/218/comments","events_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/218/events","html_url":"https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/218","id":98934294,"number":218,"title":"Add \"remove_field\" option","user":{"login":"maximpashuk","id":5028850,"avatar_url":"https://avatars.githubusercontent.com/u/5028850?v=3","gravatar_id":"","url":"https://api.github.com/users/maximpashuk","html_url":"https://github.com/maximpashuk","followers_url":"https://api.github.com/users/maximpashuk/followers","following_url":"https://api.github.com/users/maximpashuk/following{/other_user}","gists_url":"https://api.github.com/users/maximpashuk/gists{/gist_id}","starred_url":"https://api.github.com/users/maximpashuk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maximpashuk/subscriptions","organizations_url":"https://api.github.com/users/maximpashuk/orgs","repos_url":"https://api.github.com/users/maximpashuk/repos","events_url":"https://api.github.com/users/maximpashuk/events{/privacy}","received_events_url":"https://api.github.com/users/maximpashuk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-04T10:04:47Z","updated_at":"2015-08-04T16:25:36Z","closed_at":null,"body":"Many logstash plugins has this option.\r\n\r\nOption can have behaviour \"strip document fields before index\".\r\nSo people can strip field \"type\", for example, to not have both \"_type\" and \"type\" fields in document."},"comment":{"url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/comments/127665022","html_url":"https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/218#issuecomment-127665022","issue_url":"https://api.github.com/repos/logstash-plugins/logstash-output-elasticsearch/issues/218","id":127665022,"user":{"login":"untergeek","id":1020383,"avatar_url":"https://avatars.githubusercontent.com/u/1020383?v=3","gravatar_id":"","url":"https://api.github.com/users/untergeek","html_url":"https://github.com/untergeek","followers_url":"https://api.github.com/users/untergeek/followers","following_url":"https://api.github.com/users/untergeek/following{/other_user}","gists_url":"https://api.github.com/users/untergeek/gists{/gist_id}","starred_url":"https://api.github.com/users/untergeek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untergeek/subscriptions","organizations_url":"https://api.github.com/users/untergeek/orgs","repos_url":"https://api.github.com/users/untergeek/repos","events_url":"https://api.github.com/users/untergeek/events{/privacy}","received_events_url":"https://api.github.com/users/untergeek/received_events","type":"User","site_admin":false},"created_at":"2015-08-04T16:25:36Z","updated_at":"2015-08-04T16:25:36Z","body":"The `remove_field` option only exists in the filter plugins.  However, the functionality you seek exists already.\r\n\r\nYou can eliminate the `type` field, or move it to the `@metadata` object and use the `document_type` setting in your elasticsearch output block:\r\n\r\n```\r\nfilter {\r\n  mutate {\r\n    add_field => { \"[@metadata][type]\" => \"%{type}\" }\r\n    remove_field => \"type\"\r\n  }\r\n}\r\n\r\noutput {\r\n  elasticsearch {\r\n    ...\r\n    document_type => \"%{[@metadata][type]}\"\r\n  }\r\n}\r\n```\r\n\r\nThis example would remove the `type` field from your elasticsearch output—but still allow you to define `_type` accordingly—because none of the contents of `@metadata` go into the output.\r\n\r\nThe reason `type` has persisted is that the elasticsearch output plugin assigns `_type` at index time with the value of `document_type`, and `document_type` gets the value of the logstash event field `type` if it exists, otherwise it defaults to \"logs\".  \r\n\r\nThis behavior predates the addition of the `@metadata` functionality, so this new method is fairly recent."}}