# Logstash exclude\_keys

**URL:** https://forums.suse.com/t/logstash-exclude-keys/11328
**Category:** General
**Created:** [July 31, 2018, 6:42pm UTC](https://forums.suse.com/t/logstash-exclude-keys/11328 "2018-07-31T18:42:06Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Arun\_Murugappan](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@Arun\_Murugappan](https://forums.suse.com/u/Arun_Murugappan)
#### Post date: [July 31, 2018, 6:42pm UTC](https://forums.suse.com/t/logstash-exclude-keys/11328/1 "2018-07-31T18:42:06Z")

</div>

nput file:kvoptions.log  
{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}

Configuration file:  
input  
{  
file  
{  
path =\> “/home/murugar/Documents/kvoptions.log”  
type =\> “file”  
start\_position =\> “beginning”  
sincedb\_path=\> “/dev/null”

}  
}  
filter  
{  
grok  
{  
match =\> [“message”,"%{GREEDYDATA:msg}"]  
}

```
kv
{
source => "msg"
field_split => ",\{\}"
value_split => ":"
exclude_keys => ["ConfigurationObjectType"]
}

```

}

output  
{

stdout  
{  
codec =\> rubydebug  
}  
}

Obtained Ouput  
{  
“message” =\> “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,  
“@version” =\> “1”,  
“@timestamp” =\> “2018-07-18T01:43:30.128Z”,  
“path” =\> “/home/murugar/Documents/kvoptions.log”,  
“host” =\> “0.0.0.0”,  
“type” =\> “file”,  
“msg” =\> “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,  
““Name”” =\> “admin”,  
““ConfigurationObjectType”” =\> “ExecutionGroup”  
}

Expected Ouput:

{  
{  
“message” =\> “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,  
“@version” =\> “1”,  
“@timestamp” =\> “2018-07-18T01:43:30.128Z”,  
“path” =\> “/home/murugar/Documents/kvoptions.log”,  
“host” =\> “0.0.0.0”,  
“type” =\> “file”,  
“msg” =\> “{“Name”:“admin”,“ConfigurationObjectType”:“ExecutionGroup”}”,  
““Name”” =\> “admin”,

}

}

In other word, the last bolded line should not appear. Why isnt exclude\_keys working?