Remove array field if empty 6.1 version


(Eshwar Kumar ) #1

Please suggest how to remove array field if empty? I have tried below config :
Logstash version is : 6.1.1

if [tags] == [] {
mutate {
remove_field => ["tags"]
}
}

But getting logstash exception:
[2018-03-01T15:07:56,000][FATAL][logstash.runner ] The given configuration is invalid. Reason: Failed to parse right-hand side of conditional [str]pipeline:31:8:[tags] == []


(Eshwar Kumar ) #2

found solution


(Robert Cowart) #3

Please share it, so that others might find it in the future.

Thanks.


(Eshwar Kumar ) #4
ruby {
        code => 'event.set("[is_tags_empty]", "true") if event.get("[tags]").length == 0'
    }

    if [is_tags_empty] {
        mutate {
            remove_field => ["tags","is_tags_empty"]
        }
    }

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.