Remove processor

The Remove processor removes a field (Remove) or removes a field and all its nested fields (Remove by prefix) from your documents.

To remove a field:

Select Create → Create processor.
From the Processor menu, select Remove to remove a field or Remove by prefix to remove a field and all its nested fields.
Set the Source Field to the field you want to remove.

This functionality uses the Elasticsearch Remove processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

YAML reference

In YAML mode, configure the remove processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Remove

Parameter	Type	Required	Description
`from`	string	Yes	Field to remove.
`ignore_missing`	boolean	No	When `true`, skip this processor if the field is missing.

		- action: remove
  from: attributes.temp_field

Remove by prefix

Removes a field and all nested fields matching a prefix.

Note

The where clause is not supported on remove_by_prefix. This processor cannot be used inside condition blocks.

Parameter	Type	Required	Description
`from`	string	Yes	Prefix to match. All fields under this prefix are removed.

		- action: remove_by_prefix
  from: attributes.debug