How to remove fields with - values in logstash filter?

Elastic Stack Logstash
1

I have a patterns like :

  1. 2021-10-15 20:00:13 2396 tstur1 /ftp/workspace/ this is message
  2. 2020-10-15 18:00:13 - - this is the second message
    The fields are Date, Time, SessionId, path and message.
    The grok pattern used is :
    %{DATE:date} %{TIME:time} %{DATA:sessionid} %{DATA:username} %{DATA:path} %{GREEDYDATA:message}

is it possible to do a dynamic filter in logstash that will remove any fields with - value?

1 Like
2

Absolutely!
After your grok statement you can write an if statement.

if [sessionid] == "-" {
   mutate {
      remove_field => ["sessionid"]
   }
}
1 Like
3

Another possible solution is a prune filter with the blacklist_values options.

1 Like
4

thank you @AquaX for the help

5

thank you @Badger it worked

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.