Remove a field from an array based on another field's value

[endersonmaia]

I need to remove some fields from an array of JSON objects based on the value of another field on the same array element.

the input is:

{
  "id": "123456",
  "pagamentos": [
    {"tipo": "R$", "valor": 23.75, "cartao": "", "troco": 0.0},
    {"tipo": "CC", "valor": 23.75, "cartao": "visa", "troco": 0.25}
  ]
}

In this example, I need to remove :

• the field cartao from pagamentos[] array if the field tipo is not CC;
• the field troco from pagamentos[] array if the field tipo is not R$.

The desired output would be :

{
  "id": "123456",
  "pagamentos": [
    {"tipo": "R$", "valor": 23.75, "troco": 0.25 },
    {"tipo": "CC", "valor": 23.75, "cartao": "visa" }
  ]
}

[paz]

Hello,

I'm not sure if this can be done with an existing filter plug-in without some recursions (if anyone knows by all means point it out), but it can be done somewhat cleanly with some custom Ruby code.

This should do what you want.
P.S. Since you didn't mention which version of Logstash you use (although I assume it's 5+) and event accessing methods have changed in 5.x, I have included both versions. Just delete the unneeded one.

filter {
    ## Logstash < 5.x
    ruby {
        code => "event['pagamentos'].each {|v| v.delete('cartao') if v['tipo'] != 'CC' ; v.delete('troco') if v['tipo'] != 'R$'}"
    }
    ## Logstash >= 5.x
    ruby {
        code => "event.set('[pagamentos]',event.get('[pagamentos]').each {|v| v.delete('cartao') if v['tipo'] != 'CC' ; v.delete('troco') if v['tipo'] != 'R$'})"
    }
}

[endersonmaia]

@paz, I was trying something with the filter-prune plugin, but it's all or nothing, as far as I could test, your solution worked for me, thanks!