Does it possible remove all nested fields except white-list?

Elastic Stack Logstash
1

source:
{
"message":"aaa"
"req":{
"url":"..."
......
},
"string1":"value",,
"stringN":"value"
"int1":1,
"intN":1,
"object1":{},
"objectN":{},
}

  1. Can I remove fields of type "object" except some whitelist? (remove object1...objectN? but leave req)
    2.does it possible to use type of i conditions? like
    if typeof [somefield] == "object" {
    drop{}
    }
2

The prune filter allows removal of fields by name and by value but not by type so you probably can't use it here, but it's actually a reasonable feature request. I've filed logstash-filter-prune #6 for this. Until that's implemented you'd have to use a ruby filter.

3

Does prune now supports nested fields?

with source
{
"obj": {
"0": "...",
"1": "...",
"2": "...",
"11": "...",
"stack": "asdasdasd"
}
}

I'm trying to prune 0...11 subfields :
prune {
blacklist_names => [ "err.\d+" ]
}

but its not work

4

It probably doesn't support nested fields, but if it does I would expect it to use the nested field syntax (see https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).