Logstash filter mutate remove_field inside of an array

If the volumes array has multiple entries (which it probably does sometimes, otherwise there would be little reason to make it an array), then you could either add enough remove_field entries to cover all of them, or you could use a ruby filter to iterate over the array

    ruby {
        code => '
            volumesArray = event.get("volumes")
            if volumesArray
                newVolumesArray = []
                volumesArray.each { |x|
                    x.delete("lun-mapping-list")
                    newVolumesArray << x
                }
                event.set("volumes", newVolumesArray)
            end
        '
    }
1 Like