title: Remove Field from event by pattern
body: <p>So I'm using a standard ELK stack to analyse Apache access logs, which is working well, but I'm looking to break out URL parameters as fields, using the KV filter, in order to allow me to write better queries. </p>
  
  <p>My problem is that that app I'm analysing has 'cache-busting' dynamically generated parameters, which leads to tens of thousands of 'fields', each occurring once. ElasticSearch seems have severe trouble with this and they have no value to me, so I'd like to remove them. Below is an example of the pattern</p>
  
  <p><code>
  GET /page?rand123PQY=ABC&amp;other_var=something
  GET /page?rand987ZDQ=DEF&amp;other_var=something</code></p>
  
  <p>In the example above, the parameters I want to remove start 'rand'. Currently my logstash.conf uses grok to extract fields from the access logs, followed by kv to extract Query string parameters:</p>
  
  <p><code>
  filter {
    grok {
      path =&gt; "/var/log/apache/access.log" 
      type =&gt; "apache-access"
    }
    kv {
      field_split =&gt; "&amp;?"
    }
  }
  </code>
  Is there a way I can filter out any fields matching the pattern <code>rand[A-Z0-9]*=[A-Z0-9]*</code>? Most examples I've seen are targeting fields by exact name, which I cannot use. I did wonder about regexing the request field into a new field, running KV on that, then removing it. Would that work?</p>