Delete attributes by value in Logstash 5.1.1


(Raymond Canzanese) #1

We have recently upgraded from Logstash 2.2.4 to Logstash 5.1.1. Previously, we used the following to remove "-" valued attributes:

code => "event.to_hash.keep_if{|k,v| v != '-'}"

The new Event API breaks this code: https://www.elastic.co/guide/en/logstash/5.0/breaking-changes.html#_ruby_filter_and_custom_plugin_developers and leaves us looking for an alternative solution. Is there a way to achieve this same effect with the new Event API?


(Magnus B├Ąck) #2

Just use the prune filter. Make sure to install v3.0.0 or later, released last week, to get support for the new event API.


(Raymond Canzanese) #4

Thanks, hadn't come across that filter before.

Link for the lazy: https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.