› › ›

Remove processor

Removes existing fields. If one field doesn’t exist, an exception will be thrown.

Table 37. Remove Options

Name	Required	Default	Description
`field`	yes	-	Fields to be removed. Supports template snippets.
`ignore_missing`	no	`false`	If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
`keep`	no	-	Fields to be kept. When set, all fields other than those specified are removed.
`description`	no	-	Description of the processor. Useful for describing the purpose of the processor or its configuration.
`if`	no	-	Conditionally execute the processor. See Conditionally run a processor.
`ignore_failure`	no	`false`	Ignore failures for the processor. See Handling pipeline failures.
`on_failure`	no	-	Handle failures for the processor. See Handling pipeline failures.
`tag`	no	-	Identifier for the processor. Useful for debugging and metrics.

Here is an example to remove a single field:

{
  "remove": {
    "field": "user_agent"
  }
}

To remove multiple fields, you can use the following query:

{
  "remove": {
    "field": ["user_agent", "url"]
  }
}

You can also choose to remove all fields other than a specified list:

{
  "remove": {
    "keep": ["url"]
  }
}

© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/remove-processor.html