Logstash bug while removing field

Hey,

I realized that the following line :

remove_field => [ "[doc][vegetables][%{[tmp_vegetable_data][name]}]" ]

Was not only removing [doc][vegetables][%{[tmp_vegetable_data][name]}], but was also like removing [tmp_vegetable_data][name]. Note that if you use stdout { codec => rubydebug}, you will still be able to see the [tmp_vegetable_data][name] field content, like if it was still there, but, in reality, you cannot use the [tmp_vegetable_data][name] field content anymore (it's like empty in reality, even if the rubydebug codec is showing it as still available/present).

I don't think it is an expected behaviour.

(logstash 7.14.0)

Have a good day !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.