Modifying Tags in nested JSON array

Elastic Stack Logstash
1

I'm looking to modify tags within a nested JSON array via a ruby filter. Basically, the log looks similar to the following:
{
“message” => “”,
“@version => “1”,
“@timestamp” => “2016-06-02T13:02:33.966Z”,
“host” => “xxx.xx.xxx.xx”,
“headers” => {
“request_method” => “GET”,
“request_path” => “/”,
“request_uri” => “/”,
“http_date” => “…
}
}

There are several keys within the "headers" nested array that begin with 'http_', and also which have dots; ie: 'file.owner'. In short, I want to eliminate the 'http_' part of the key, and sub an underscore for every '.'.

Is this possible in a ruby filter, or is there a better way to do it such as the translate plugin?

2

The de_dot filter should be able to help with the dots. Removing the "http_" prefix is certainly possible with a ruby filter. Since this is an old post I won't spend time writing an example in case you've already solved it.