How to remove any field matching a string

Elastic Stack Logstash
1

I have found the ruby fix for deleting events if they are 'nil', but I am wondering if there is a clean/easy way to delete any event if it matches one of a few strings.

Essentially, I have some integer fields coming in. But if the system sending the JSON doesn't get an integer value, it can either pass a "-" or "(empty)".

Fields with these values are of no use to me. So I would like to simply refrain from sending them to Elastic.

What would be the best practice for this?

And as a second part, what would happen if I used the mutate convert to cast these to integers? What will happen if I try to cast a non-integer based value to an integer?

2

Essentially, I have some integer fields coming in. But if the system sending the JSON doesn't get an integer value, it can either pass a "-" or "(empty)".

Fields with these values are of no use to me. So I would like to simply refrain from sending them to Elastic.

Have a look at the prune filter.

And as a second part, what would happen if I used the mutate convert to cast these to integers?

By the look of the code you'd get an exception in the log. It should still let the message through, I think. If that causes the event to be dropped I'd say it's a bug. It would be easy to try, of course.