Remove_field with regex as argument

Elastic Stack Logstash
1

I'd like to remove all fields that begin by "foobar". Is there any way to pass a regex to the remove_field command, or is there any remove command that accepts regexs?

2

Use a prune filter.

1 Like
3

Unfortunately the field is a subfield (obtained parsing a JSON), and the prune filter doesn't support that.

I thought about using the mutate filter to rename the subfield as a root field, but the rename command doesn't allow regexs, so I'm back to square one. Any other ideas?

4

Then you'll have to use a ruby filter. I'm pretty sure examples have been posted in the past.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.