Question on logstash removing field from json string and saving back to same field

Elastic Stack Logstash
1

Is it possible to read a json string, remove specified fields then have that json string saved back into a single field with-ought parsing the json data into separate fields. So i would be reading a field from a database table called message: {"client": "ABC", "routnumber": "123789550", "Source": "Customer", "lastname": "smith"} .. Remove the field lastname. and have that json string saved into logstash as
message: {"client": "ABC", "routnumber": "123789550", "Source": "Customer"}

2

If you install the logstash-filter-json_encode filter then you can do it...

input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "[foo]" => '{ "a": 1, "b" : 2}' } }
    json { source => "foo" target => "[@metadata][json]" }
    mutate { remove_field => [ "[@metadata][json][b]" ] }
    json_encode { source => "[@metadata][json]" target => "foo" }
}
output  { stdout { codec => rubydebug { metadata => false } } }

will produce

       "foo" => "{\"a\":1}",
3

THANK YOU .. that worked.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.