Logstash Json remove nested properties that have empty field name

[david.preston (David)]

Hi,

Are there any "out of the box" logstash functions for removing json properties that have empty field names.

e.g.
{
    "event":  {
         "data":  {
                "" : "some value"
         }
    }
}

I'm not able to reference this field to remove it and elastic wont accept it as a log.

I've tried:

mutate {
     remove_field => ["[event][data][]" ]
 }

but it needs a name in the last part of
[event][data][ ] of property reference
I've tried also from ruby code too, but also needs a name in property reference.

event.remove('[event][data][]')

I've also tried replacing in the "message" before parsing to json - but i couldn't get the regex to match ("":"").

e.g.

mutate {
  gsub => [ "message", '"":"",', ""]
}

I cant remove the parent object - because there are other properties in there that are valid.

Thanks

[david.preston (David)]

I've got a basic solution similar to this:

ref = "[event][properties][data]"
obj = event.get(ref)
if obj
  if obj.has_key?("")     
       obj.delete("")
       event.set(ref, obj)
  end
end