title: How not to parse some fields by logstash?
body: <p>I have a log-file which looks like this (simplified):   </p>
  
  <pre><code> { "startDate": "2015-05-27", "endDate": "2015-05-27", 
      "request" : {"requestId":"123","field2":1,"field2": 2,"field3":3, ....} }
  </code></pre>
  
  <p>Log-stash tries to <code>parse</code> all fields including field "request". But is it possible not to parse this field?<br>
  I want to see the "request" field in <code>elastic-search</code> but it shouldn't be parsed.</p>
  
  <p>here is a part of my config file:</p>
  
  <pre><code>input {
      file {
          type =&gt; "json"
          path =&gt; [
                  "/var/log/service/restapi.log"
          ]
          tags =&gt; ["restapi"]
      }
  }
  
  filter {
      ruby {
          init =&gt; "require 'socket'"
          code =&gt; "
             event['host'] = Socket.gethostname.gsub(/\..*/, '')
             event['request'] = (event['request'].to_s);
          "
      }
  
      if "restapi" in [tags] {
          json {
              source =&gt; "message"
          }
          date {
                  match =&gt; [ "date_start", "yyyy-MM-dd HH:mm:ss" ]
                  target =&gt; "date_start"
           }
          date {
                  match =&gt; [ "date_end", "yyyy-MM-dd HH:mm:ss" ]
                  target =&gt; "date_end"
          }
          date {
                  match =&gt; [ "date", "yyyy-MM-dd HH:mm:ss" ]
                  target =&gt; "date"
          }
      }
  }
  output {
      if "restapi" in [tags] {
          elasticsearch {
              hosts =&gt; ["......."]
              template_name =&gt; "logs"
              template =&gt; "/etc/logstash/templates/service.json"
              template_overwrite =&gt; true
              index =&gt; "service-logs-%{+YYYY.MM.dd}"
              idle_flush_time =&gt; 20
              flush_size =&gt; 500
          }
      }
  }
  </code></pre>
  
  <p>here is my template file:</p>
  
  <pre><code>{
    "template" : "service-*",
    "settings" : {
      "index": {
              "refresh_interval": "60s",
              "number_of_shards": 6,
              "number_of_replicas": 2
          }
    },
    "mappings" : {
      "logs" : {
          "properties" : {
          "@timestamp" : { "type" : "date", "format" : "dateOptionalTime" },
          "@version" : { "type" : "integer", "index" : "not_analyzed" },
          "message": { "type" : "string", "norms" : { "enabled" : false } },
          "method" : { "type" : "string", "index" : "not_analyzed" },
          "traffic_source" : { "type" : "string", "index" : "not_analyzed" },
          "request_path" : { "type" : "string", "index" : "not_analyzed" },
          "status" : { "type" : "integer", "index" : "not_analyzed" },
          "host_name" : { "type" : "string", "index" : "not_analyzed" },
          "environment" : { "type" : "string", "index" : "not_analyzed" },
          "action" : { "type" : "string", "index" : "not_analyzed" },
          "request_id" : { "type" : "string", "index" : "not_analyzed" },
          "date" : { "type" : "date", "format" : "dateOptionalTime" },
          "date_start" : { "type" : "date", "format" : "dateOptionalTime" },
          "date_end" : { "type" : "date", "format" : "dateOptionalTime" },
          "adnest_type" : { "type" : "string", "index" : "not_analyzed" },
          "request" : { "type" : "string", "index" : "not_analyzed" }
        }
      }
    }
  }
  </code></pre>
  
  <p>here is from logstash.log   </p>
  
  <pre><code>response=&gt;{"create"=&gt;{"_index"=&gt;"logs-2017.02.08", "_type"=&gt;"json", "_id"=&gt;"AVoeNgdhD5iEO87EVF_n", "status" =&gt;400, "error"=&gt; "type"=&gt;"mapper_parsing_exception", "reason"=&gt;"failed to parse [request]", "caused_by"=&gt;{"type"=&gt;"illegal_argument_exception", "reason"=&gt;"unknown property [requestId]" }}}}, :level=&gt;:warn}
  </code></pre>