title: Filebat/Logstash remove unwanted fields & values from output
body: <p>My Filebeat configuration is very simple - </p>
  
  <pre><code>- input_type: log
    paths:
      - C:\log\FilebeatInputTest.txt
  
  output.logstash:
    hosts: ["http://X.X.X.X:XXXX"]
  </code></pre>
  
  <p>if I write something in <code>ilebeatInputTest.txt</code> like - <code>This is from Filebeat</code></p>
  
  <p>I get output in Elastic search something like - 
  <code>.......
  "index": "logstash-"
  "source" : {
      "@timestamp": "2017-05-19T06:41:02.663Z",
      "beat": {
          "hostname": "CHITTARS02",
          "name": "CHITTARS02",
          "version": "5.4.0"
      },
      "input_type": "log",
      "message": "This is from Filebeat",
      "offset": 23,
      "source": "C:\\log\\FilebeatInputTest.txt",
      "type": "log"
  }
  .....</code></p>
  
  <p>My pipeline is <code>Filebeat(monitoring FilebeatInputTest.txt) &gt; Logstash &gt; Elasticsearch</code></p>
  
  <p><code>logstash.cnf</code>  as follows - </p>
  
  <pre><code>input {
  
      beats {
          port =&gt; 25000
      }
  }
  output {
  
      elasticsearch {
          hosts =&gt; ["http://xx.xx.xx.xx:XX"]
          user =&gt; "elastic"
          password =&gt; "changeme"
      }
  }
  </code></pre>
  
  <p>Problem : Can I remove all unwanted keys &amp; values from output? That is, I want my output should be something like -</p>
  
  <p><code>.......
  "index": "logstash-"
  "source" : {
      "message": "This is from Filebeat",
  }
  ......</code></p>
  
  <p>I want to remove <code>"@timestamp", "beat","input_type""offset","source","type"</code></p>
  
  <p>I tried with following - </p>
  
  <pre><code>filter{
      prune {
          blacklist_names =&gt; ["@timestamp", "beat","input_type""offset","source","type"]
      }
  
  }
  </code></pre>
  
  <p>And</p>
  
  <pre><code>filter{
      mutate {
          remove_field =&gt; ["@timestamp", "beat","input_type""offset","source","type"]
      }
  }
  </code></pre>
  
  <p>But no help, results are same</p>