# How to exclude XML & json key-value if key length is greater than 15 char and value length is greater than 100 char

**URL:** https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248
**Category:** Logstash
**Created:** [April 15, 2021, 2:11pm UTC](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248 "2021-04-15T14:11:17Z")
**Posts on this page:** 1
**Showing post:** 8

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 15, 2021, 4:44pm UTC](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248/8 "2021-04-15T16:44:15Z")

</div>

OK, so you want to recursively remove long keys/values from your event. That will require a ruby function. That is going to be similar to [this](https://discuss.elastic.co/t/to-exclude-around-350-fields-in-json-in-logstash/239019/6).

```
    xml { source => "message" target => "xml" force_array => false }
    ruby {
        code => '
            def removeBigThings(object, name, event)
                if object
                    if object.kind_of?(Hash) and object != {}
                        object.each { |k, v| removeBigThings(v, "#{name}[#{k}]", event) }
                    elsif object.kind_of?(Array) and object != []
                        object.each_index { |i|
                            removeBigThings(object[i], "#{name}[#{i}]", event)
                        }
                    else
                        lastElement = name.gsub(/^.*\[/, "").gsub(/\]$/, "")
                        if lastElement.length > 15 or object.to_s.length > 100
                            event.remove(name)
                        end
                    end
                end
            end

            event.to_hash.each { |k, v|
                removeBigThings(v, "[#{k}]", event)
            }
        '
    }

```

Note that I have used force\_array =\> false. You do not have to, I just do not like everything being an array with one member.

Note also that I used "or" in the test `lastElement.length > 15 or object.to_s.length > 100`. You said "and" but that would result in nothing being removed.

Note also that this will delete [message], since that is more than 100 characters long. If you only want to modify things in [xml] you could change

```
            event.to_hash.each { |k, v|
                removeBigThings(v, "[#{k}]", event)
            }

```

to

```
removeBigThings(event.get("xml"), "[xml]", event)
```

---

_[View the full topic](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248)._