How to remove a field


(sampasei) #1

Hi all,
i have a log (txt) file like this one:

#fields    ts    proto    trans_id    test    test2
1453139999.678755    udp    43124    - -

Each field is tab separated. Using a grock filter i can take the field values, but i'm not able to remove a field if its value is equal to "-" (like test and test2 in the example above).
How can i do this?
thanks


(Magnus B├Ąck) #2

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html

filter {
  if [name-of-field] == "-" {
    mutate {
      remove_field => ["name-of-field"]
    }
  }
}

(system) #3