Logstash remove N/A field

I am trying to remove all the fields which have N/A next to the them like "toto: N/A", I am currently removing them with a enormous IF forest which I have hard coded but I would like a better alternative, to an enormous amount of if's, let's say I have this:

toto1: N/A
test1 {
toto2: true
toto3: N/A
}

I want to transform it into :

test1 {
toto2: true
}

Can I do this with anything other then a Ruby filter? If not, how do I do it with Ruby?

You could try

    ruby {
        init => '
            def doSomething(object, name, event)
                #puts "doSomething called for #{name}"
                if object
                    if object.kind_of?(Hash) and object != {}
                        object.each { |k, v| doSomething(v, "#{name}[#{k}]", event) }
                    elsif object.kind_of?(Array) and object != []
                        object.each_index { |i|
                            doSomething(object[i], "#{name}[#{i}]", event)
                        }
                    else
                        if object == "N/A"
                            event.remove(name)
                        end
                    end
                end
            end
        '
        code => '
            event.to_hash.each { |k, v|
                doSomething(v, "[#{k}]", event)
            }
        '
    }

That modifies the event whilst iterating over it. I don't know enough about ruby function calls to know whether that has the possibility of blowing up.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.