Remove Empty String Value

Elastic Stack Logstash
1

Running Logstash 6.4.1

I have a field that contains an array of numbers. I am converting the field to string values so that I can translate them to their text values with gsub. All of this works great, except that for one value which I "delete" from the array, it leaves behind an empty array value. How can I get rid of this?

Pipeline Config

  mutate {
    convert => {
    "[user][groups]" => "string"
    }
  }
  mutate {
    gsub => [
      "[user][groups]", "9439", "",
      "[user][groups]", "9427", "K4_",

JSON Output
image

Appearance in Kibana
image

2

You could do it using a ruby filter.

ruby { code => 'event.set("[user][groups]", event.get("[user][groups]").reject { |x| x.empty? })' }
1 Like
3

Fantastic!

Any chance you can school me on what's going on here? Looks like event.set targets a field, event.get grabs the current values and then reject...does something?

4

Yes, event.get fetches the current value of the [user][groups] field. reject is a method of the Ruby Array class, which returns a new array that contains only those array entries for which the script block returns false. That is, it rejects entries for which the script block returns true, and x.empty? returns true for empty strings.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.