For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/logs/log_configuration/processors/exclude_attribute_processor.md. A documentation index is available at /llms.txt.

Exclude Attribute Processor

Overview

Use the Exclude Attribute Processor to remove a specified attribute from your logs during pipeline processing. It strips unwanted, redundant, or intermediate attributes before logs reach your indexes, archives, or forwarding destinations.

Notes:

  • This processor operates during pipeline processing and does not reduce ingestion costs. Metering occurs before pipeline processing.
  • Reserved attributes (such as host, source, service, status, message, timestamp) cannot be excluded.
  • This processor removes attributes only, not tags.

Use cases

  • Clean up intermediate parsing artifacts: Some pipelines create temporary attributes during processing. For example, a Grok parser may extract a raw chunk that feeds into a nested pipeline. The Exclude Attribute Processor removes these intermediate attributes from the final log.
  • Improve log readability: Remove verbose or noisy attributes that clutter logs in Explorer, archives, and forwarding destinations.

Before and after state of logs

Before:

{
  "timestamp": "2026-06-10T09:14:02.887Z",
  "status": "error",
  "service": "payment-processor",
  "message": "Transaction failed for customer cust_38271",
  "http.response.body": "{\"error\":\"card_declined\",\"tx_id\":\"TX-8847291\",\"amount\":249.99,\"currency\":\"USD\",\"customer_id\":\"cust_38271\",\"provider\":\"stripe\",\"retry_allowed\":false,\"gateway_ref\":\"gw-9182-xk\"}",
  "tx_id": "TX-8847291",
  "amount": 249.99,
  "currency": "USD",
  "error_code": "card_declined"
}

Exclude Attribute Processor

Create an Exclude Attribute Processor to remove the http.response.body attribute. The useful fields (tx_id, amount, currency, error_code) have already been extracted by an earlier Grok parser, so the full response body is no longer needed.

After processing:

{
  "timestamp": "2026-06-10T09:14:02.887Z",
  "status": "error",
  "service": "payment-processor",
  "message": "Transaction failed for customer cust_38271",
  "tx_id": "TX-8847291",
  "amount": 249.99,
  "currency": "USD",
  "error_code": "card_declined"
}

The http.response.body attribute is removed from the log before it reaches indexes, archives, or forwarding destinations.

API

Use the Datadog Log Pipeline API endpoint with the following Exclude Attribute Processor JSON payload:

{
  "type": "exclude-attribute",
  "name": "<PROCESSOR_NAME>",
  "is_enabled": true,
  "attribute_to_exclude": "<ATTRIBUTE_NAME>"
}
ParameterTypeRequiredDescription
typeStringYesType of the processor.
nameStringNoName of the processor.
is_enabledBooleanNoIf the processor is enabled or not. Default: false.
attribute_to_excludeStringYesName of the log attribute to remove from the log event.

Further reading

Additional helpful documentation, links, and articles:

Discover Datadog PipelinesDOCUMENTATION more more