Delete field based on value with variable fieldnames

[Sjaak01 (Sjaak)]

Hi,

I was wondering if it is possible to remove a field based on the field value without knowing the field name?

In my case I know all unwanted data will contain the value "0000" but the name of the field containing the data will be unknown. There might be multiple fields with the same unwanted data in a single event.

I know you can use conditionals to filter data but that always seem to require a field name.

[Badger]

    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v == "0000"
                    event.remove(k)
                end
            }
        '
    }

[Sjaak01 (Sjaak)]

Thanks, I'll try that out