# Can't delete empty field **URL:** \ **Category:** Logstash\ **Created:** [October 1, 2020, 12:40pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678 "2020-10-01T12:40:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [October 1, 2020, 12:40pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/1 "2020-10-01T12:40:21Z")
Hi, i want to parse a json response and load data into elasticsearch via logstash , i try to delete **arrDate** and **depDate** fields if it's empty ,,,but i still got this error, [2020-10-01T13:24:13,646][WARN][logstash.outputs.elasticsearch][main][8dafa128c9ab419583f2bd9f8b39512559e9b500bbfe515cd29596f761e77443] Could not index event to Elasticsearch. {:status=\>400, :action=\>["update", {:\_id=\>"63198", :\_index=\>"invoices", :routing=\>nil, :\_type=\>"\_doc", :retry\_on\_conflict=\>1}, #LogStash::Event:0x3a09cff0], :response=\>{"update"=\>{"\_index"=\>"invoices", "\_type"=\>"\_doc", "\_id"=\>"63198", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [bookings.arrDate] of type [date] in document with id '63198'. Preview of field's value: ''", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"cannot parse empty date"}}}}} **my filter :** filter { split { field =\> "[invoices]" } mutate { rename =\> { "[invoices][invoiceRef]" =\> "invoiceRef" "[invoices][invoiceId]" =\> "invoiceId" "[invoices][invoiceType]" =\> "invoiceType" "[invoices][invoiceStatus]" =\> "invoiceStatus" "[invoices][invoiceDate]" =\> "invoiceDate" "[invoices][amount]" =\> "amount" "[invoices][currency]" =\> "currency" "[invoices][billingTo]" =\> "billingTo" "[invoices][customerId]" =\> "customerId" "[invoices][customer]" =\> "customer" "[invoices][distributorId]" =\> "distributorId" "[invoices][distributor]" =\> "distributor" "[invoices][bookings]" =\> "bookings" } } if [bookings.arrDate] == "" { mutate { remove\_field =\> ["bookings.arrDate"] } } } **my data:** { "invoices": [ { "invoiceRef": "2020/B/000186", "invoiceId": 63625, "invoiceType": "Facture", "invoiceStatus": "validée", "invoiceDate": "2020-06-30", "amount": 143.960, "currency": "TND", "billingTo": "Didi Travel", "customerId": "", "customer": "", "distributorId": 13666, "distributor": "DIDI TRAVEL", "bookings": [ { "bookingRef": 559986, "bookingId": 559986, "arrDate": "2020-06-27", "depDate": "2020-06-28", "detail": "Club Marmara Palm Beach Hammamet 4\* Tunisie,Hammamet chambre double VP Standard Vue piscine - Soft All Inclusive 2 pax : 2 adultes 27 juin 2020 - 28 juin 2020 (1 nuit) Amine Ben Ouali" } ] }]} any hel please ! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 1, 2020, 2:30pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/2 "2020-10-01T14:30:57Z")
> [@hiba](#): > > [bookings.arrDate] Both references should be [bookings][0][arrDate] since it is an array ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [October 2, 2020, 11:31am UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/3 "2020-10-02T11:31:12Z")
Hi @Badger, i change the filter to : if [bookings][0][arrDate] == "" { mutate { remove\_field =\> ["[bookings][0][arrDate]"] } } if [bookings][0][depDate] == "" { mutate { remove\_field =\> ["[bookings][0][depDate]"] } } But the type of the fields **depDate** and **arrDate** change to "text". So, i create an index with mapping where i put these two fields as a "date" type, but i got the same error of parse ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 2, 2020, 1:51pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/4 "2020-10-02T13:51:07Z")
Maybe you have events where the array has multiple entries. ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [October 2, 2020, 2:02pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/5 "2020-10-02T14:02:00Z")
yes i have ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 2, 2020, 2:25pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/6 "2020-10-02T14:25:38Z")
OK, so you have to remove all of the empty dates. You could try something like ``` ruby { code => ' bookings = event.get("bookings") if bookings bookings.each_index { |x| if [bookings][x]["arrDate"] == "" event.remove("[bookings][#{x}][arrDate]") end if [bookings][x]["depDate"] == "" event.remove("[bookings][#{x}][depDate]") end } end ' } ``` ---
**Author:** ![hiba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hiba/32/110919_2.png) [@hiba](https://discuss.elastic.co/u/hiba)\ **Post date:** [October 2, 2020, 2:50pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/7 "2020-10-02T14:50:30Z")
> Blockquote[2020-10-02T15:48:15,508][WARN][logstash.outputs.elasticsearch][main][c063fff6f011cbeb262319fc0b3497018846d1d2ecb9baf70b73cdd0c43665ec] Could not index event to Elasticsearch. {:status=\>400, :action=\>["update", {:\_id=\>"63368", :\_index=\>"invoices", :routing=\>nil, :\_type=\>"\_doc", :retry\_on\_conflict=\>1}, #LogStash::Event:0x4e3700c6], :response=\>{"update"=\>{"\_index"=\>"invoices", "\_type"=\>"\_doc", "\_id"=\>"63368", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [bookings.arrDate] of type [date] in document with id '63368'. Preview of field's value: ''", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"cannot parse empty date"}}}}} filter { split { field =\> "[invoices]" } mutate { rename =\> { "[invoices][invoiceRef]" =\> "invoiceRef" "[invoices][invoiceId]" =\> "invoiceId" "[invoices][invoiceType]" =\> "invoiceType" "[invoices][invoiceStatus]" =\> "invoiceStatus" "[invoices][invoiceDate]" =\> "invoiceDate" "[invoices][amount]" =\> "amount" "[invoices][currency]" =\> "currency" "[invoices][billingTo]" =\> "billingTo" "[invoices][customerId]" =\> "customerId" "[invoices][customer]" =\> "customer" "[invoices][distributorId]" =\> "distributorId" "[invoices][distributor]" =\> "distributor" "[invoices][bookings]" =\> "bookings" } remove\_field =\> ["billingTo"] } ruby { code =\> ' bookings = event.get("bookings") if bookings bookings.each\_index { |x| if [bookings][x]["arrDate"] == "" event.remove("[bookings][#{x}][arrDate]") end if [bookings][x]["depDate"] == "" event.remove("[bookings][#{x}][depDate]") end } end ' } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 30, 2020, 2:50pm UTC](https://discuss.elastic.co/t/cant-delete-empty-field/250678/8 "2020-10-30T14:50:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.