Processors - Remove - 《Elasticsearch v7.9 Reference》

Remove processor

Removes existing fields. If one field doesn’t exist, an exception will be thrown.

Table 29. Remove Options

Name	Required	Default	Description
`field`	yes	-	Fields to be removed. Supports template snippets.
`ignore_missing`	no	`false`	If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
`if`	no	-	Conditionally execute this processor.
`on_failure`	no	-	Handle failures for this processor. See Handling Failures in Pipelines.
`ignore_failure`	no	`false`	Ignore failures for this processor. See Handling Failures in Pipelines.
`tag`	no	-	An identifier for this processor. Useful for debugging and metrics.

Here is an example to remove a single field:

{
  "remove": {
    "field": "user_agent"
  }
}

To remove multiple fields, you can use the following query:

{
  "remove": {
    "field": ["user_agent", "url"]
  }
}