---
title: Exclude Attribute Processor
description: Remove a specified attribute from your logs during pipeline processing
breadcrumbs: >-
  Docs > Log Management > Log Configuration > Processors > Exclude Attribute
  Processor
---

# Exclude Attribute Processor

## Overview{% #overview %}

Use the Exclude Attribute Processor to remove a specified attribute from your logs during pipeline processing. It strips unwanted, redundant, or intermediate attributes before logs reach your indexes, archives, or forwarding destinations.

**Notes**:

- This processor operates during pipeline processing and does not reduce ingestion costs. Metering occurs before pipeline processing.
- Reserved attributes (such as `host`, `source`, `service`, `status`, `message`, `timestamp`) cannot be excluded.
- This processor removes attributes only, not tags.

## Use cases{% #use-cases %}

- **Clean up intermediate parsing artifacts**: Some pipelines create temporary attributes during processing. For example, a Grok parser may extract a raw chunk that feeds into a [nested pipeline](https://docs.datadoghq.com/logs/log_configuration/pipelines.md#nested-pipelines). The Exclude Attribute Processor removes these intermediate attributes from the final log.
- **Improve log readability**: Remove verbose or noisy attributes that clutter logs in Explorer, archives, and forwarding destinations.

## Before and after state of logs{% #before-and-after-state-of-logs %}

{% collapsible-section %}
#### Example: Removing a parsed attribute with the Exclude Attribute Processor

**Before:**

```json
{
  "timestamp": "2026-06-10T09:14:02.887Z",
  "status": "error",
  "service": "payment-processor",
  "message": "Transaction failed for customer cust_38271",
  "http.response.body": "{\"error\":\"card_declined\",\"tx_id\":\"TX-8847291\",\"amount\":249.99,\"currency\":\"USD\",\"customer_id\":\"cust_38271\",\"provider\":\"stripe\",\"retry_allowed\":false,\"gateway_ref\":\"gw-9182-xk\"}",
  "tx_id": "TX-8847291",
  "amount": 249.99,
  "currency": "USD",
  "error_code": "card_declined"
}
```

**Exclude Attribute Processor**

Create an Exclude Attribute Processor to remove the `http.response.body` attribute. The useful fields (`tx_id`, `amount`, `currency`, `error_code`) have already been extracted by an earlier Grok parser, so the full response body is no longer needed.

**After processing:**

```json
{
  "timestamp": "2026-06-10T09:14:02.887Z",
  "status": "error",
  "service": "payment-processor",
  "message": "Transaction failed for customer cust_38271",
  "tx_id": "TX-8847291",
  "amount": 249.99,
  "currency": "USD",
  "error_code": "card_declined"
}
```

The `http.response.body` attribute is removed from the log before it reaches indexes, archives, or forwarding destinations.
{% /collapsible-section %}

## API{% #api %}

Use the [Datadog Log Pipeline API endpoint](https://docs.datadoghq.com/api/v1/logs-pipelines.md) with the following Exclude Attribute Processor JSON payload:

```json
{
  "type": "exclude-attribute",
  "name": "<PROCESSOR_NAME>",
  "is_enabled": true,
  "attribute_to_exclude": "<ATTRIBUTE_NAME>"
}
```

| Parameter              | Type    | Required | Description                                             |
| ---------------------- | ------- | -------- | ------------------------------------------------------- |
| `type`                 | String  | Yes      | Type of the processor.                                  |
| `name`                 | String  | No       | Name of the processor.                                  |
| `is_enabled`           | Boolean | No       | If the processor is enabled or not. Default: `false`.   |
| `attribute_to_exclude` | String  | Yes      | Name of the log attribute to remove from the log event. |

## Further reading{% #further-reading %}

- [Discover Datadog Pipelines](https://docs.datadoghq.com/logs/log_configuration/pipelines.md)