Logstash remove after split

[tamilarasanbravo (Tamilarasan Janakiraman)]

Hi Team,

I have configured a logstash http which receives JSON data. As part of the logstash filter I split a json field/value of array into 5 different key values. i.e.,

original Field

commits : { author : TJ
email: tj@email.com
added: adding details
modified: asadasd
}

Got modified into

commits.author: tj
commits.email : tj@email.com
commits.added : adding detail
commits.modified : asasas

Now, after it got split using split filter I am trying to delete (commits.modified) but I am unable to do so.

Pasting my current filter for further reference.

filter {
    split { field => "commits" }
    mutate { remove_field => [ "[commits.modified]" ] }
}

Looking forward to any help.

Regards
TJ

[Badger]

If [modified] is a field inside the [commits] object then in logstash that would be referred to as [commits][modified]. [commits.modified] would refer to a field that contains a period in its name.

If [commits] is a hash then I would expect split to log an error. It operates on arrays and strings, not hashes.