How to exclude key value pair from KV filter if Key size greater than 15 char

The kv filter cannot do that for you, you would have to use a ruby filter. I have not tested it but something like

ruby {
    code => '
        event.to_hash.each { |k, v|
            if k.length > 15
                event.remove(k)
            end
        }
    '
}
1 Like