Does it possible remove all nested fields except white-list?


  1. Can I remove fields of type "object" except some whitelist? (remove object1...objectN? but leave req)
    2.does it possible to use type of i conditions? like
    if typeof [somefield] == "object" {

The prune filter allows removal of fields by name and by value but not by type so you probably can't use it here, but it's actually a reasonable feature request. I've filed logstash-filter-prune #6 for this. Until that's implemented you'd have to use a ruby filter.

Does prune now supports nested fields?

with source
"obj": {
"0": "...",
"1": "...",
"2": "...",
"11": "...",
"stack": "asdasdasd"

I'm trying to prune 0...11 subfields :
prune {
blacklist_names => [ "err.\d+" ]

but its not work

It probably doesn't support nested fields, but if it does I would expect it to use the nested field syntax (see