# Remove a field from an array based on another field's value

**URL:** https://discuss.elastic.co/t/remove-a-field-from-an-array-based-on-another-fields-value/86474
**Category:** Logstash
**Created:** [May 19, 2017, 5:57pm UTC](https://discuss.elastic.co/t/remove-a-field-from-an-array-based-on-another-fields-value/86474 "2017-05-19T17:57:23Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![endersonmaia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/endersonmaia/32/17308_2.png) [@endersonmaia](https://discuss.elastic.co/u/endersonmaia)
#### Post date: [May 19, 2017, 5:57pm UTC](https://discuss.elastic.co/t/remove-a-field-from-an-array-based-on-another-fields-value/86474/1 "2017-05-19T17:57:23Z")

</div>

I need to remove some fields from an array of JSON objects based on the value of another field on the same array element.

the input is:

```
{
  "id": "123456",
  "pagamentos": [
    {"tipo": "R$", "valor": 23.75, "cartao": "", "troco": 0.0},
    {"tipo": "CC", "valor": 23.75, "cartao": "visa", "troco": 0.25}
  ]
}

```

In this example, I need to remove :

- the field `cartao` from `pagamentos[]` array if the field `tipo` is not `CC`;
- the field `troco` from `pagamentos[]` array if the field `tipo` is not `R$`.

The desired output would be :

```
{
  "id": "123456",
  "pagamentos": [
    {"tipo": "R$", "valor": 23.75, "troco": 0.25 },
    {"tipo": "CC", "valor": 23.75, "cartao": "visa" }
  ]
}
```

---

<div class="post-metadata">

### Author: ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [May 22, 2017, 12:01pm UTC](https://discuss.elastic.co/t/remove-a-field-from-an-array-based-on-another-fields-value/86474/2 "2017-05-22T12:01:47Z")

</div>

Hello,

I'm not sure if this can be done with an existing filter plug-in without some recursions (if anyone knows by all means point it out), but it can be done somewhat cleanly with some custom Ruby code.

This should do what you want.  
P.S. Since you didn't mention which version of Logstash you use (although I assume it's 5+) and event accessing methods have changed in 5.x, I have included both versions. Just delete the unneeded one.

```auto
filter {
    ## Logstash < 5.x
    ruby {
        code => "event['pagamentos'].each {|v| v.delete('cartao') if v['tipo'] != 'CC' ; v.delete('troco') if v['tipo'] != 'R$'}"
    }
    ## Logstash >= 5.x
    ruby {
        code => "event.set('[pagamentos]',event.get('[pagamentos]').each {|v| v.delete('cartao') if v['tipo'] != 'CC' ; v.delete('troco') if v['tipo'] != 'R$'})"
    }
}
```

---

<div class="post-metadata">

### Author: ![endersonmaia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/endersonmaia/32/17308_2.png) [@endersonmaia](https://discuss.elastic.co/u/endersonmaia)
#### Post date: [May 23, 2017, 2:51pm UTC](https://discuss.elastic.co/t/remove-a-field-from-an-array-based-on-another-fields-value/86474/3 "2017-05-23T14:51:40Z")

</div>

@paz, I was trying something with the `filter-prune` plugin, but it's all or nothing, as far as I could test, your solution worked for me, thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 20, 2017, 2:52pm UTC](https://discuss.elastic.co/t/remove-a-field-from-an-array-based-on-another-fields-value/86474/4 "2017-06-20T14:52:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
