How to filter/remove fields that have certain naming pattern

with JSON input, i have field like
build.artifacts.hyper-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.tgz.archive: "SOME VALUE1" "SOME VALUE2"
build.artifacts.hyper-symbols-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.tgz.archive : "SOME VALUE3"

I would like to suppress/ mutate->remove fields to such fields. in logstash filter,

  1. how can we search for pattern like field names starting with "build.artifacts*"?
  2. how can we find the length of field name if needed?

note: here i want to search the key and not its value.

please advise

Does the prune filter help?

how can we find the length of field name if needed?

You probably need to use a ruby filter. What do you want to do with the length?

thank you Magnus.

Objective: to ignore any json fields that are under this structure "build.artifacts.*"
build.artifacts.hyper-mingw64-x86_64-debug-master.0.0.1677.rd3e0b27a.tgz.archive: "SOME VALUE1" "SOME VALUE2"

i tried the following construct that didint work
blacklist_names => [ "%{[build][artifacts]}"]


can you please advise?

Yeah, the prune filter doesn't work with nested fields. If you want to delete the whole [build][artifacts] hierarchy a simple mutate filter that deletes [build][artifacts] should do.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.