Hello, I use the logstash SNMP plugin to query my device. After that, I do some split and field renaming as below. input { snmp { interval => 5 hosts => [ {host => "udp:ip/port" community => "secret"} ] tables => [ { name =>…

[image] Adriann: "1.3.6.1.2.1.2.1", In my configuration file, I had this above oid and the additional document was related to this. It was some leftover form testing solution show basically the deleting it and the split function was my solution.

I would guess there is an empty entry in the interfaces array that the snmp input emits. I would remove that using ruby before doing the split.

So I notice that an empty document is a leftover of a document that at the beginning had an interfaces field. I removed the after a split because they are no longer necessary. How would you delete this document using ruby?

ruby { code => ' if event.get("interfaces") event.cancel end ' } This is deleting the whole event. Can I somehow narrow this just to a document containing that field?

Yes, you can write arbitrary code to evaluate the fields of the event to see whether or not you want to retain it.

Can you pass me some resource to learn from? I have never coded in ruby nor in ruby in logstash.

Perhaps you could use a conditional and the drop filter to drop the event. https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html

Discuss the Elastic Stack

How to remove document I logstash pipilnie that has no usefull fields

Elastic Stack Logstash

Badger October 26, 2020, 10:28pm 4

In ruby you would call event.cancel to delete an entire event. There is an example here.

Topic		Replies	Views
Remove unnecessary documents Logstash Logstash	10	4256	June 14, 2017
How to remove dynamical field? Logstash	12	1279	July 6, 2017
[SOLVED] SNMP trap input plugin Logstash	4	9300	July 6, 2017
Safely remove tcp input plugin's "host" and "port" fields Logstash	4	645	May 5, 2021
Custom Logstash pipeline configuration file Logstash	6	544	November 13, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to remove document I logstash pipilnie that has no usefull fields

Related topics