Remove

Transform Elastic Compatible

Synopsis

Removes one or more fields from the document. Can handle both single fields and arrays of fields to remove.

Schema

remove:
  - field: <ident|ident[]>
  - description: <text>
  - if: <script>
  - ignore_failure: <boolean>
  - ignore_missing: <boolean>
  - on_failure: <processor[]>
  - on_success: <processor[]>
  - tag: <string>

Configuration

Field	Required	Default	Description
field	Y	-	Field or array of fields to remove
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, continue silently if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier

Details

The processor supports template variables in field names and can remove nested fields using dot notation.

note

When multiple fields are specified, the processor attempts to remove all of them. If ignore_missing is set to true, execution continues for the remaining fields even if a field removal fails.

warning

Be careful when removing nested fields as it might affect the structure of your document. Always ensure parent fields exist before attempting to remove child fields.

Examples

Single Field

Remove a single field from the document...	{ "user": { "id": "12345", "password": "secret", "email": "[email protected]" } } remove: - field: user.password
to avoid disclosing sensitive data:	{ "user": { "id": "12345", "email": "[email protected]" } }

Multiple Fields

Remove multiple fields at once...	{ "debug": true, "temp_data": ["a", "b", "c"], "result": "success", "message": "Operation completed" } remove: - field: - debug - temp_data
cleaning up temporary fields:	{ "result": "success", "message": "Operation completed" }

Templates

Remove fields using template variables...	{ "type": "user_data", "user_data_temp": "temporary", "user_data_cache": "cached" } remove: - field: - "{{{type}}}_temp" - "{{{type}}}_cache"
with dynamic field names:	{ "type": "user_data" }

Error Handling

Handle missing fields gracefully...	{ "field1": "value1" } remove: - field: - field1 - field2 - ignore_missing: true - on_failure: - append: field: tags value: removal_incomplete
with appropriate errors:	{ "tags": ["removal_incomplete"] }