# How to remove nested fields in logstash 5.4

**URL:** https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190
**Category:** Logstash
**Created:** [September 28, 2017, 11:32pm UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190 "2017-09-28T23:32:52Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![elasticuser1](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)
#### Post date: [September 28, 2017, 11:32pm UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190/1 "2017-09-28T23:32:52Z")

</div>

Hi, I have below json. I want to remove all paths.\*.get.parameters.default fields. Could not find the right solution. Please advise. Thank you.

---

<div class="post-metadata">

### Author: ![elasticuser1](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)
#### Post date: [September 29, 2017, 3:02am UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190/2 "2017-09-29T03:02:18Z")

</div>

I came up with below after research, but it's not working. Need help with ruby code which is very new to me ☹

```
ruby {
code => "
   if event.get('[paths][/v1/page][get][parameters]') != nil
   event.set('[paths][/v1/page][get][parameters]',
   event.get('[paths][/v1/page][get][parameters]').each { |k|
      if k['default'] != nil
        k.delete('default')
        print k
      end
      }
    );
   end
"

```

}

My questions -

1. Do I have to set the event after delete? Not sure why my code is not working..
2. How to use wildcards in reading json?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 4, 2017, 8:33pm UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190/4 "2017-10-04T20:33:26Z")

</div>

Iterate over all keys in "paths", then iterate over the "get.parameters` values and remove the "default" field. Something like this:

```nohighlight
event.get('paths').each_value { |url|
  url['get']['parameters'].each { |param|
    param.delete('default')
  }
}

```

---

<div class="post-metadata">

### Author: ![elasticuser1](https://avatars.discourse-cdn.com/v4/letter/e/a3d4f5/32.png) [@elasticuser1](https://discuss.elastic.co/u/elasticuser1)
#### Post date: [October 6, 2017, 5:05pm UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190/5 "2017-10-06T17:05:43Z")

</div>

Thanks @magnusbaeck for your help. I made it work with this code -

```
ruby {
    code => "
        if event.get('[apihub][paths]') != nil
        event.set('[apihub][paths]',
        event.get('[apihub][paths]').each_value { |url|
        url['get']['parameters'].each { |param|
        param.delete('default')
        }
        }
        );
        end
    "
 }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 3, 2017, 5:05pm UTC](https://discuss.elastic.co/t/how-to-remove-nested-fields-in-logstash-5-4/102190/6 "2017-11-03T17:05:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.