# How can I remove the object in nested array by logstash?

**URL:** <https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006>\
**Category:** Logstash\
**Created:** [September 25, 2019, 10:13am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006 "2019-09-25T10:13:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![living](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/living/32/54853_2.png) [@living](https://discuss.elastic.co/u/living)\
**Post date:** [September 25, 2019, 10:13am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/1 "2019-09-25T10:13:19Z")

</div>

Hi,  
The log output like this:

```
{
        "@timestamp" => 2019-09-19T17:30:48.984Z,
       "characterid" => "20036815",
    "inventory_item" => [
        [0] {
                 "item_equipped" => true,
                    "item_count" => 1,
                     "item_type" => "1",
                       "item_id" => 102022
        },
        [1] {
                 "item_equipped" => true,
                    "item_count" => 1,
                     "item_type" => "3",
                       "item_id" => 23201
        },
        [2] {
                 "item_equipped" => false,
                    "item_count" => 1,
                     "item_type" => "2",
                       "item_id" => 910
        },
        [3] {
                 "item_equipped" => false,
                    "item_count" => 1,
                     "item_type" => "3",
                       "item_id" => 21400
        },
        [4] {
                 "item_equipped" => false,
                    "item_count" => 1,
                     "item_type" => "2",
                       "item_id" => 21401
        },
        [5] {
                 "item_equipped" => true,
                    "item_count" => 1,
                     "item_type" => "4",
                       "item_id" => 21402
        }
    ]
}

```

I want to output like this, after filter:

```
{
        "@timestamp" => 2019-09-19T17:30:48.984Z,
       "characterid" => "20036815",
    "inventory_item" => [
        [0] {
                 "item_equipped" => true,
                    "item_count" => 1,
                     "item_type" => "1",
                       "item_id" => 102022
        },
        [1] {
                 "item_equipped" => true,
                    "item_count" => 1,
                     "item_type" => "3",
                       "item_id" => 23201
        },
        [2] {
                 "item_equipped" => true,
                    "item_count" => 1,
                     "item_type" => "4",
                       "item_id" => 21402
        }
    ]
}

```

`[inventory_item][item_equipped] != true` then will be remove.

I used ruby plugin. But it seems don't work.

```
ruby {
    code => "
        event.get('inventory_item').each do |item|
            if item['item_equipped'] == false
                event.remove('[#{item}]')
            end
        end
        
    "
}

```

Do you have any suggtions?

---

<div class="post-metadata">

**Author:** ![chandu5565](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@chandu5565](https://discuss.elastic.co/u/chandu5565)\
**Post date:** [September 25, 2019, 10:26am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/2 "2019-09-25T10:26:15Z")

</div>

U can use mutate to remove fields like below

filter {  
mutate { remove\_field =\> "[inventory\_item][3]"  
}

This should remove the complete array 3.

If u want to delete a field in array "[inventory\_item][3][item\_equipped]" replace the remove field with this.

---

<div class="post-metadata">

**Author:** ![living](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/living/32/54853_2.png) [@living](https://discuss.elastic.co/u/living)\
**Post date:** [September 25, 2019, 10:30am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/3 "2019-09-25T10:30:51Z")

</div>

Thanks for reply.  
But `array 3`'s `item_equipped` maybe is `true`, or maybe is `false`.  
And I don't know how many `item_equipped` will be `true`, and how many item in `inventory_item`?

---

<div class="post-metadata">

**Author:** ![chandu5565](https://avatars.discourse-cdn.com/v4/letter/c/c57346/32.png) [@chandu5565](https://discuss.elastic.co/u/chandu5565)\
**Post date:** [September 25, 2019, 10:34am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/4 "2019-09-25T10:34:12Z")

</div>

Am not sure but you can try this

filter {  
mutate { remove\_field =\> "[inventory\_item][item\_equipped]" }  
}  
Leave the middle array empty

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 25, 2019, 1:32pm UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/5 "2019-09-25T13:32:17Z")

</div>

```
    ruby {
        code => '
            a = event.get("inventory_item")
            a = a.delete_if { |x| ! x["item_equipped"] }
            event.set("inventory_item", a)
        '
    }

```

Error checking is left as an exercise for the reader.

---

<div class="post-metadata">

**Author:** ![living](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/living/32/54853_2.png) [@living](https://discuss.elastic.co/u/living)\
**Post date:** [September 26, 2019, 2:24am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/6 "2019-09-26T02:24:46Z")

</div>

Thank you !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2019, 2:24am UTC](https://discuss.elastic.co/t/how-can-i-remove-the-object-in-nested-array-by-logstash/201006/7 "2019-10-24T02:24:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.