How to remove a field

(sampasei) #1

Hi all,
i have a log (txt) file like this one:

#fields    ts    proto    trans_id    test    test2
1453139999.678755    udp    43124    - -

Each field is tab separated. Using a grock filter i can take the field values, but i'm not able to remove a field if its value is equal to "-" (like test and test2 in the example above).
How can i do this?

(Magnus B├Ąck) #2

filter {
  if [name-of-field] == "-" {
    mutate {
      remove_field => ["name-of-field"]

(system) #3