How I can drop anyone fields if a value in this field contains "null"?

Elastic Stack Logstash
1

How I can drop anyone fields if a value in this field contains "null"?
I use plugins kv, xml, and json sometimes value in the field = null. I need a flexible solution, that so as not to describe each field separately.
Example:
["user"=null&"node"="server1"&"proxy"=true&"id"=null]

2

Use the prune filter?

3

Yes, but (Value type is hash)
I need set each key

prune {
    blacklist_values => [ "user", "null",
                          "id", "null",
                          "node", "null" ]
  }
4

I search flexible solution because I have ~10-15 key in each pattern..

5

If I try:

 prune {
                                        blacklist_values => [ ".*", "null" ]
                              }

this does not work...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.