Link Search Menu Expand Document Documentation Menu

This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.


The delete_entries processor deletes entries, such as key-value pairs, from an event. You can define the keys you want to delete in the with-keys field following delete_entries in the YAML configuration file. Those keys and their values are deleted.


You can configure the delete_entries processor with the following options.

Option Required Description
with_keys Yes An array of keys for the entries to be deleted.


To get started, create the following pipeline.yaml file:

    - delete_entries:
        with_keys: ["message"]

Next, create a log file named logs_json.log and replace the path in the file source of your pipeline.yaml file with that filepath. For more information, see Configuring Data Prepper.

For example, before you run the delete_entries processor, if the logs_json.log file contains the following event record:

{"message": "hello", "message2": "goodbye"}

When you run the delete_entries processor, it parses the message into the following output:

{"message2": "goodbye"}

If message does not exist in the event, then no action occurs.

350 characters left

Have a question? .

Want to contribute? or .