How to remove_field for json data by http_poller at all once

Elastic Stack Logstash
1

Hi.
I want to filter for jason getting by http_poller plugin.
For example, it's below.

"content" => [
  [0] {
    "AList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y,
      }
    ],
    "BList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y",
      }
    ],
  },

  [1] {
    "AList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y,
      }
    ],
    "BList" => [
      [0] {
        "name" => "X",
      },
      [1] {
        "name" => "Y",
      }
    ],
  }
],

"allFetched" => false,
"result" => true,
"number" => 0
}

I want to delete below fields.
[content][0][AList]
[content][0][BlList]
[content][1][AList]
[content][1][BList]

I could success below remove_field. But, it is inefficient.

filter {
        mutate {
                remove_field => [
                "[content][0][AList]",
                "[content][1][AList]",
                "[content][0][BList]",
                "[content][1][BList]"
                ]
        }
}

Is there any way to delete them all at once?

filter {
        mutate {
                remove_field => [
                "[content][*][AList]",
                "[content][*][BList]",
                "[content][*][CList]"
                ]
        }
}
2

I did.
It's very helpful.

filter {
        ruby {
                code => '
                        event.get("content").each_with_index { |b,index|
                                event.remove("[content][#{index}][AList]")
                        }
                '
        }
}
1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.