How to extract data from multiline(codec)

Does anyone know how to extract data from under the codec multiline.
After parse xml data I need to avoid the header (prefix of name measData ) for whole of ingested rows...
it makes also some keyword field and multi field. How to prepare such data for pure ingest in elastic?

  "_index": "logstash-s",
  "_type": "_doc",
  "_id": "LgsyuHwBykpzZ66Oiyu9",
  "_version": 1,
  "_score": null,
  "fields": {
    "measData.succImmediateAssignProcs": [
    "measData.measInfoId": [
    "measData.userLabel.keyword": [
      "RNC Telecomville"
    "measData.userLabel": [
      "RNC Telecomville"
    "measData.measInfoId.keyword": [

or in the other word how to move dynamically attributes EsmExtDbModifyTimeoutResponses, measInfoId etc to the root

If measData is an object, then see here. If you want to remove a prefix from the key name you could try

ruby {
    code => '
        event.to_hash.each { |k, v|
            if k =~ /^measData\./
                newK = k.sub(/^measData\./, "")
                event.set(newK, event.remove(k))
1 Like

oh, many thank @Badger will try and get back with result :wink:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.