How to drop any fields containing the word "PublicKey" from logstash

Elastic Stack Logstash
1

Hello team,
I wanted to drop all fields which containaing PublicKey word in the field name.

date=2019-05-10 time=11:37:47 PublicKey="abc" type.PublicKey="xyz" PublicKey.subtype="pqr" level="notice" vd="vdom1" eventtime=1557513467369913239

I want to drop all fields which contains PublicKey.

I have tried below Ruby code but it is not working:

 ruby {
    code => '
      event.to_hash.keys.each { |k| event.remove(k) if k.include?("PublicKey") }
    '
  }

Also:

ruby {
    code => '
      event.to_hash.keys.each { |k| 
        if k.include?("PublicKey") 
          event.remove(k) 
        end 
      }
    '
  }
2 
input { generator { count => 1 lines => [ 'date=2019-05-10 time=11:37:47 PublicKey="abc" type.PublicKey="xyz" PublicKey.subtype="pqr" level="notice" vd="vdom1" eventtime=1557513467369913239' ] } }
output { stdout { codec => rubydebug { metadata => false } } }
filter {
    kv {}
    ruby {
        code => '
            event.to_hash.keys.each { |k| event.remove(k) if k.include?("PublicKey") }
        '
    }
}

works as expected for me. Can you provide a reproducible example?

1 Like