How to remove/drop entire logs after checking a condition in nested json fields

[Anusha_Kusanghi]

Hie ,

Im trying to check a condition for nested json fields and if the condition is met I want to drop the entire data , but it is not working

Source:

"Data" => [
[0] {
"Scales" => [
[0] {
"TaskInfos" => [
[0] {
"Text1" => "",
"Text2" => ""
}
],
"HasErrorState" => true
}
]
}
]

Logstash script:
filter{
if [type] == "digital"
{
if [Data][Scales][HasErrorState] == "true"
{
mutate {
remove_field => ["Data"]
}

}
}
}

Can you please help me with the solution

TIA
Anusha

[Badger]

@Anusha_Kusanghi

if [Data][Scales][HasErrorState] == "true"

The first two fields are arrays. Try [Data][0][Scales][0][HasErrorState]

[Anusha_Kusanghi]

Yes that in deed works , but how can we do it with more entries than one ? dynamically

[Badger]

Write a ruby filter that iterates over the arrays.