How to remove nested fields in logstash 5.4


#1

Hi, I have below json. I want to remove all paths.*.get.parameters.default fields. Could not find the right solution. Please advise. Thank you.


#2

I came up with below after research, but it's not working. Need help with ruby code which is very new to me :frowning:

ruby {
code => "
   if event.get('[paths][/v1/page][get][parameters]') != nil
   event.set('[paths][/v1/page][get][parameters]',
   event.get('[paths][/v1/page][get][parameters]').each { |k|
      if k['default'] != nil
        k.delete('default')
        print k
      end
      }
    );
   end
"

}

My questions -

  1. Do I have to set the event after delete? Not sure why my code is not working..
  2. How to use wildcards in reading json?

(Magnus B├Ąck) #4

Iterate over all keys in "paths", then iterate over the "get.parameters` values and remove the "default" field. Something like this:

event.get('paths').each_value { |url|
  url['get']['parameters'].each { |param|
    param.delete('default')
  }
}

#5

Thanks @magnusbaeck for your help. I made it work with this code -

ruby {
    code => "
        if event.get('[apihub][paths]') != nil
        event.set('[apihub][paths]',
        event.get('[apihub][paths]').each_value { |url|
        url['get']['parameters'].each { |param|
        param.delete('default')
        }
        }
        );
        end
    "
 }

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.