Logstash Ruby Filter Not Removing Fields

Elastic Stack Logstash
1

Hello,

I have logs that look like this

{
    "attachments" : [ 
        {
            "field1" : "rkredux",
            "inner_value" : [
                "check"
            ]
        },
        {
            "field1" : "kkrist",
            "inner_value" : [
                "uncheck"
            ]
        },
        {
            "field1" : "uuiui2",
            "inner_value" : [
                "mblake"
            ]
        }
    ]
}

and my LS pipeline with a ruby filter looks like this

input {
  http {
    port => 5011
  }
  
}
filter {
  json{
    source => "message"
  }

  ruby {
    code => 
    "
      index = -1
      for inner in event.get('[attachments]') do
        index += 1
          event.remove('[attachments][index][inner_value]')
      end
    "
  }

}

output {
  stdout {
  }
}

But this pipeline does not remove the inner_value array from the fields inside and does not throw any ruby exception either. I expect my output logs to look like this

{
        "attachments" : [ 
            {
                "field1" : "rkredux"
            },
            {
                "field1" : "kkrist"
               
            },
            {
                "field1" : "uuiui2"
            
            }
        ]
    }
2

Try something like this.

3

Hi Rahul,

what about something like:

ruby {
  code => "
    attachments = event.get('attachments').map { |item| item.delete('inner_value') }
    event.set('attachments', attachments)
  "
}
4

Thanks. @Fabio-sama That returns this but that is not what I am looking for. See snippet below from a docker stdout.

attachments" => [
logstash      |         [0] [
logstash      |             [0] "check"
logstash      |         ],
logstash      |         [1] [
logstash      |             [0] "uncheck"
logstash      |         ],
logstash      |         [2] [
logstash      |             [0] "mblake"
logstash      |         ]
logstash      |     ],
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.