Remove processor

The remove processor is used to remove a field from a document.

Syntax

The following is the syntax for the remove processor:

  1. {
  2.     "remove": {
  3.         "field": "field_name"
  4.     }
  5. }

copy

Configuration parameters

The following table lists the required and optional parameters for the remove processor.

ParameterRequired/OptionalDescription
fieldRequiredThe name of the field containing the data to be removed. Supports template snippets. The following metadata fields are not allowed to be removed: _index, _version, _version_type, and _id. Note that _id is not allowed to be removed when there’s a specified external version for the ingesting document.
descriptionOptionalA brief description of the processor.
ifOptionalA condition for running the processor.
ignore_failureOptionalSpecifies whether the processor continues execution even if it encounters errors. If set to true, failures are ignored. Default is false.
on_failureOptionalA list of processors to run if the processor fails.
tagOptionalAn identifier tag for the processor. Useful for debugging in order to distinguish between processors of the same type.

Using the processor

Follow these steps to use the processor in a pipeline.

Step 1: Create a pipeline

The following query creates a pipeline, named remove_ip, that removes the ip_address field from a document:

  1. PUT /_ingest/pipeline/remove_ip
  2. {
  3.   "description": "Pipeline that excludes the ip_address field.",
  4.   "processors": [
  5.     {
  6.       "remove": {
  7.         "field": "ip_address"
  8.       }
  9.     }
  10.   ]
  11. }

copy

Step 2 (Optional): Test the pipeline

It is recommended that you test your pipeline before you ingest documents.

To test the pipeline, run the following query:

  1. POST _ingest/pipeline/remove_ip/_simulate
  2. {
  3.   "docs": [
  4.     {
  5.       "_index": "testindex1",
  6.       "_id": "1",
  7.       "_source":{
  8.          "ip_address": "203.0.113.1",
  9.          "name": "John Doe"
  10.       }
  11.     }
  12.   ]
  13. }

copy

Response

The following example response confirms that the pipeline is working as expected:

  1. {
  2.   "docs": [
  3.     {
  4.       "doc": {
  5.         "_index": "testindex1",
  6.         "_id": "1",
  7.         "_source": {
  8.           "name": "John Doe"
  9.         },
  10.         "_ingest": {
  11.           "timestamp": "2023-08-24T18:02:13.218986756Z"
  12.         }
  13.       }
  14.     }
  15.   ]
  16. }

Step 3: Ingest a document

The following query ingests a document into an index named testindex1:

  1. PPUT testindex1/_doc/1?pipeline=remove_ip
  2. {
  3.   "ip_address": "203.0.113.1",
  4.   "name": "John Doe"
  5. }

copy

Step 4 (Optional): Retrieve the document

To retrieve the document, run the following query:

  1. GET testindex1/_doc/1

copy