# How to remove subfield using ruby

**URL:** https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072
**Category:** Logstash
**Created:** [December 5, 2016, 4:57pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072 "2016-12-05T16:57:44Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)
#### Post date: [December 5, 2016, 4:57pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072/1 "2016-12-05T16:57:44Z")

</div>

Hi ,

I am using ruby filter to remove fields that start with 'ID'. In the same way how can i remove subfield of a field called 'outputdata'.

Below, code couldn't remove.  
ruby {  
code =\> "  
event.to\_hash.keys.each { |k|  
event.remove(k) if k.start\_with?('[outputdata.ID](http://outputdata.ID):')  
}

Thank you

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 5, 2016, 5:46pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072/2 "2016-12-05T17:46:48Z")

</div>

Which version of Logstash?

---

<div class="post-metadata">

### Author: ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)
#### Post date: [December 5, 2016, 5:49pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072/3 "2016-12-05T17:49:38Z")

</div>

i'm using logstash 2.3.2.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 5, 2016, 8:14pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072/4 "2016-12-05T20:14:19Z")

</div>

event.to\_hash returns a hash that might contain other hashes, i.e. if the `outputdata` field has subfields you can access its hash via `event['outputdata']`. Something like this should work:

```nohighlight
event['outputdata'].keys.each { |k|
  event['outputdata'].remove(k) if k.start_with?('ID')
}

```

---

<div class="post-metadata">

### Author: ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)
#### Post date: [December 5, 2016, 8:51pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072/5 "2016-12-05T20:51:46Z")

</div>

Thank you . It worked but 'remove' is not available for hash instead using 'delete' as below worked.

code =\> "  
event['outputdata'].keys.each { |k|  
event['outputdata'].delete(k) if k.start\_with?('ID')  
}

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 2, 2017, 8:51pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072/6 "2017-01-02T20:51:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.