Logstash mutate remove field name 'JSON'

Elastic Stack Logstash
1

I am trying to remove a field name "JSON" in my mongoDB record, while dumping in ELK. But it is not working, may be the case of reserve keyword.

Below is the document structure:

"date" : <date>,
"name" : "xyz",
"JSON" : <JSON String>

I wan to remove JSON field. I already tried to rename this field and then remove that also didn't help.

Below is the filter code with rename:

mutate {
    rename => { 'JSON' => "data" }
    remove_field => ["data"]
}

Thanks in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.