Remove json object from nested log

Elastic Stack Logstash
1

How can I use ruby code or some other filter plugin to detect and remove json object fields from my nested json logs.

This is required because the fields can either be json objects or strings. If I remove the json objects after parsing all the fields then the next time the key becomes a string I won't face a mapper_exception.

I have tried to write ruby code and got close with following:

ruby {
        code => '
            event.to_hash.each do |field, value|
                if value.is_a?(Hash) 
                    event.remove(field)
                end
            end
        '
  }

But this only removes the fields parsed from the objects instead of removing the objects themselves.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.