How to extract data from multiline(codec)

[INS (Borys)]

Hi
Does anyone know how to extract data from under the codec multiline.
After parse xml data I need to avoid the header (prefix of name measData ) for whole of ingested rows...
it makes also some keyword field and multi field. How to prepare such data for pure ingest in elastic?

{
  "_index": "logstash-s",
  "_type": "_doc",
  "_id": "LgsyuHwBykpzZ66Oiyu9",
  "_version": 1,
  "_score": null,
  "fields": {
    "measData.succImmediateAssignProcs": [
      "789"
    ],
    "measData.measInfoId": [
      "Node1"
    ],
    "measData.userLabel.keyword": [
      "RNC Telecomville"
    ],
    "measData.userLabel": [
      "RNC Telecomville"
    ],
    "measData.measInfoId.keyword": [
      "Node1"

[INS (Borys)]

or in the other word how to move dynamically attributes EsmExtDbModifyTimeoutResponses, measInfoId etc to the root

[Badger]

If measData is an object, then see here. If you want to remove a prefix from the key name you could try

ruby {
    code => '
        event.to_hash.each { |k, v|
            if k =~ /^measData\./
                newK = k.sub(/^measData\./, "")
                event.set(newK, event.remove(k))
            end
        }
    '
}

[INS (Borys)]

oh, many thank @Badger will try and get back with result