How to remove subfield using ruby

Elastic Stack Logstash
1

Hi ,

I am using ruby filter to remove fields that start with 'ID'. In the same way how can i remove subfield of a field called 'outputdata'.

Below, code couldn't remove.
ruby {
code => "
event.to_hash.keys.each { |k|
event.remove(k) if k.start_with?('outputdata.ID:')
}

Thank you

2

Which version of Logstash?

3

i'm using logstash 2.3.2.

4

event.to_hash returns a hash that might contain other hashes, i.e. if the outputdata field has subfields you can access its hash via event['outputdata']. Something like this should work:

event['outputdata'].keys.each { |k|
  event['outputdata'].remove(k) if k.start_with?('ID')
}
5

Thank you . It worked but 'remove' is not available for hash instead using 'delete' as below worked.

code => "
event['outputdata'].keys.each { |k|
event['outputdata'].delete(k) if k.start_with?('ID')
}

Thanks

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.