Delete value from filed in recursive way

Elastic Stack Logstash
1

Hi
I need to remove from a few fields in the recursive way some value so I've tried in two steps but without success, can You check what's wrong

input data:

"ue_stat" => "undefined-undefined",
 "s_gw" => "122.123.205.100-undefined",
 "psm_info2_lte" => "undefined-undefined",
"psm_info_lte" => "undefined-undefined-undefined-undefined"

================================


   ruby {
    code => "
      hash = event.to_hash
      hash.each do |k,v|
        if v == 'undefined-'
          event.remove(v)
        end
      end
    "
  }
  
  
  
   ruby {
    code => "
      hash = event.to_hash
      hash.each do |k,v|
        if v == '[-]*undefined'
          event.remove(v)
        end
      end
    "
  }
2

today I've tried also the new one code but get the same result. I don't know where the is the root cause.

 ruby {
    code => "
    
    def stripit(value)
    value.gsub!('[-]*undefined','')
    value
    end
    
      hash = event.to_hash
      hash.each do |k,value|
        if value == '[-]*undefined'
          stripit(value)
        end
      end
    "
  }




  ruby {
    code => "
    
    def stripito(value)
    value.gsub!('undefined-','')
    value
    end
    
      hash = event.to_hash
      hash.each do |k,value|
        if value == 'undefined-'
          stripito(value)
        end
      end
    "
}
3

also this approach doesn't work

  ruby {
    code => "  
    hash = event.to_hash
      hash.each do |k,v|
        if v == '[-]*undefined'
           event.set(k, v.gsub!('[-]*undefined',''))
        end
      end
    "
  }




  ruby {
    code => "
      hash = event.to_hash
      hash.each do |k,v|
        if v == 'undefined-'
           event.set(k, v.gsub!('undefined-',''))
        end
      end
    "
  }

@Badger Can You keep an eye? on this ->
Do You have any idea? Please note that all these fields are strings

4

I found that the problem can be in regex but the same one regex works in

	mutate {
		gsub => ["ue_stat","undefined-",""]
	}

	mutate {
		gsub => ["ue_stat","[-]*undefined",""]
	}

if we put it into this method (event.set) there is a problem. But logstash doesn't spit out any bugs.

5

ok now it's clear ruby has a problem with regex so I user another method
" Using include? method from string"

ruby {
code => "
  hash = event.to_hash
  hash.each do |k,v|
  if v.is_a? String 
   if  v.include? 'undefined-'
    event.set(k, v.gsub!('undefined-',''))
    end
   end
  end
"

}

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.