Remove field based on name regex

Elastic Stack Logstash
1

This is the data I'm receiving:

       "mem" => {
            "total" => 8201703424,
             "used" => 6293446656,
             "free" => 1908256768,
           "used_p" => 0.77,
      "actual_used" => 5523927040,
      "actual_free" => 2677776384,
    "actual_used_p" => 0.67
},

Right now I only need to keep "[mem][used_p]" so I have my filter like this:

remove_field => [ "[mem][total]", "[mem][used]", "[mem][free]", "[mem][actual_used]", "[mem][actual_free]", "[mem][actual_used_p]" ]

Is there any way to do this with a regex to remove all nested fields that are NOT "used_p" so my config looks cleaner and it's easier to modify?

I'm asking because there's lots of use cases I could have. I also have one nested field which I only need "[when][_d]" but to remove all fields it's set up like this:

remove_field => [ "[when][_locale]", "[when][_d]", "serverName", "[when][_isAMomentObject]", "[when][_isUTC]", "[when][_pf]", "[when][empty]", "[when][unusedTokens]", "[when][unusedInput]", "[when][unusedInput]", "[when][overflow]", "[when][charsLeftOver]", "[when][nullInput]", "[when][invalidMonth]", "[when][invalidFormat]", "[when][userInvaled]", "[when][iso]" ]

2

I'd normally suggest the prune filter but it unfortunately doesn't support nested fields yet. You'll have to use ruby filter.

3

Would you mind letting me know how to do this? I'm not really experienced in ruby to do it myself

4

This example is fairly close to what you want: Remove a field that starts with an integer