# Logstash Json remove nested properties that have empty field name

**URL:** <https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516>\
**Category:** Logstash\
**Created:** [January 28, 2021, 2:30pm UTC](https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516 "2021-01-28T14:30:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![david.preston](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@david.preston](https://discuss.elastic.co/u/david.preston)\
**Post date:** [January 28, 2021, 2:30pm UTC](https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516/1 "2021-01-28T14:30:10Z")

</div>

Hi,

Are there any "out of the box" logstash functions for removing json properties that have empty field names.

```auto
e.g.
{
    "event": {
         "data": {
                "" : "some value"
         }
    }
}

```

I'm not able to reference this field to remove it and elastic wont accept it as a log.

I've tried:

```auto
mutate {
     remove_field => ["[event][data][]" ]
 }

```

but it needs a name in the last part of  
`[event][data][]` of property reference  
I've tried also from ruby code too, but also needs a name in property reference.

```auto
event.remove('[event][data][]')

```

I've also tried replacing in the "message" before parsing to json - but i couldn't get the regex to match ("":"").

e.g.

```auto
mutate {
  gsub => ["message", '"":"",', ""]
}

```

I cant remove the parent object - because there are other properties in there that are valid.

Thanks

---

<div class="post-metadata">

**Author:** ![david.preston](https://avatars.discourse-cdn.com/v4/letter/d/51bf81/32.png) [@david.preston](https://discuss.elastic.co/u/david.preston)\
**Post date:** [January 28, 2021, 4:40pm UTC](https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516/2 "2021-01-28T16:40:08Z")

</div>

I've got a basic solution similar to this:

```auto
ref = "[event][properties][data]"
obj = event.get(ref)
if obj
  if obj.has_key?("")     
       obj.delete("")
       event.set(ref, obj)
  end
end

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2021, 4:40pm UTC](https://discuss.elastic.co/t/logstash-json-remove-nested-properties-that-have-empty-field-name/262516/3 "2021-02-25T16:40:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.