Grok then test nested field

#1

Hello,

I'm encounter some issue on testing nested field after a grok.

grok { match => { "message" => [ ".*(?<event.action>test) xxxx %{DATA:[name]}" ] } if ( "" in [event][action] ) { mutate { remove_field => "message" } }
But it never remove my message field, wheter [event][action] exist or not.

#2

If you only want to remove the message field if the grok succeeds then use

grok {
    match => { "message" => "pattern" }
    remove_field => [ "message" ]
}

If the pattern does not match then [message] will not be removed.

#3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.