Delete attributes by value in Logstash 5.1.1

Elastic Stack Logstash
1

We have recently upgraded from Logstash 2.2.4 to Logstash 5.1.1. Previously, we used the following to remove "-" valued attributes:

code => "event.to_hash.keep_if{|k,v| v != '-'}"

The new Event API breaks this code: https://www.elastic.co/guide/en/logstash/5.0/breaking-changes.html#_ruby_filter_and_custom_plugin_developers and leaves us looking for an alternative solution. Is there a way to achieve this same effect with the new Event API?

2

Just use the prune filter. Make sure to install v3.0.0 or later, released last week, to get support for the new event API.

4

Thanks, hadn't come across that filter before.

Link for the lazy: https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.