Event API ; event.remove() does not work on key with special character ? encoding problem?

Elastic Stack Logstash
1

Hi there,

From the CouchDB input plugin, logstash receives this document:

{
  "_id": "542de4069541c1fc76a649a9fe0377c0",
  "_rev": "28-8fb537085cf219b74d13d58400245267",
  "type": "test",
  "message": "message test",
  "test": "test",
  "ExposureinµAs": 1300
}

(Notice the special character µ inside the ExposureinµAs key).

I tried to remove this field with the Ruby filter.

filter {
  if ([doc] and [doc][type] == "test"){
    ruby { 
      code => "
      event.remove('[doc][ExposureinµAs]')
      " 
    } 
  } else {
    drop {}
  }
}

And it does not work. I guest an encoding problem.

I searched on the web to find the root of it; indeed, the problem could come from either
the Ruby Logstash Plugin, or Jruby or Java. But I did not find anything.

Note that I tried this logstash config with Logstash 6.2.4 and it works. But I'm curious and actually,
I do not have the time to update the entire Elastic stack, so I would like to find a little fix (if possible)

Thanks !

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.