How to remove subfield using ruby


(saisn) #1

Hi ,

I am using ruby filter to remove fields that start with 'ID'. In the same way how can i remove subfield of a field called 'outputdata'.

Below, code couldn't remove.
ruby {
code => "
event.to_hash.keys.each { |k|
event.remove(k) if k.start_with?('outputdata.ID:')
}

Thank you


(Magnus Bäck) #2

Which version of Logstash?


(saisn) #3

i'm using logstash 2.3.2.


(Magnus Bäck) #4

event.to_hash returns a hash that might contain other hashes, i.e. if the outputdata field has subfields you can access its hash via event['outputdata']. Something like this should work:

event['outputdata'].keys.each { |k|
  event['outputdata'].remove(k) if k.start_with?('ID')
}

(saisn) #5

Thank you . It worked but 'remove' is not available for hash instead using 'delete' as below worked.

code => "
event['outputdata'].keys.each { |k|
event['outputdata'].delete(k) if k.start_with?('ID')
}

Thanks


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.