How to filter/remove fields that have certain naming pattern

Elastic Stack Logstash
1

with JSON input, i have field like
Name:Value
build.artifacts.hyper-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.tgz.archive: "SOME VALUE1"
build.artifacts.hyper-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.zip.archive: "SOME VALUE2"
build.artifacts.hyper-symbols-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.tgz.archive : "SOME VALUE3"
etc

I would like to suppress/ mutate->remove fields to such fields. in logstash filter,

  1. how can we search for pattern like field names starting with "build.artifacts*"?
  2. how can we find the length of field name if needed?

note: here i want to search the key and not its value.

please advise

2

Does the prune filter help?

how can we find the length of field name if needed?

You probably need to use a ruby filter. What do you want to do with the length?

3

thank you Magnus.

Objective: to ignore any json fields that are under this structure "build.artifacts.*"
Example:
build.artifacts.hyper-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.tgz.archive: "SOME VALUE1"
build.artifacts.hyper-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.zip.archive: "SOME VALUE2"

i tried the following construct that didint work
prune{
blacklist_names => [ "%{[build][artifacts]}"]

}

can you please advise?

4

Yeah, the prune filter doesn't work with nested fields. If you want to delete the whole [build][artifacts] hierarchy a simple mutate filter that deletes [build][artifacts] should do.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.