Does not whiteliist_names support [field][subfiled] logstash?

Hi,

Does filter/whtielist_names support [fiield][subfield]?

filter {
        prune {
                whitelist_names => ["[content][0]"]
        }
}

I'm tring above filter for below.

When no filter does, the result is below.

"content" => [
  [0] {
    "AList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y,
      }
    ],
    "BList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y",
      }
    ],
  },

  [1] {
    "AList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y,
      }
    ],
    "BList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y",
      }
    ],
  }
],

"allFetched" => false,
"result" => true,
"number" => 0
}

The result is {}. # no result.

No it does not. The documentation says

This filter currently only support operations on top-level fields, i.e. whitelisting and blacklisting of subfields based on name or value does not work.

Hi Badger,

Thank you for your reply!
I 'm sorry for the lack of confirmation.
I understand. I am anticipating the new and improved logstash.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.