Remove keys and avoid "Direct event field references have been disabled" error message

Elastic Stack Logstash
1

Hi,

I need to remove a nasty field with keys and after reading this forum I've decided to use this:

ruby { code => "event.get('[field_with_keys]').keys.each { |k| event['field_with_keys'].remove(k) }" }
mutate { remove_field => [ "field_with_keys" ] }

It works fine but now I'm getting this error in the logs:

[2018-04-20T07:10:23,876][ERROR][logstash.filters.ruby ] Ruby exception occurred: Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the Logstash 5.0 breaking changes documentation for more details.

It is not big deal but... Is there any way to rewrite event['field_with_keys'].remove(k) to be 5.0 compliant?

Thanks!

2

event.get('field_with_keys').remove(k)?

3

I bet you are right Magnus.

Deploying and testing...

4

No joy. I get this error:

2018-04-20T10:44:02,519][ERROR][logstash.filters.ruby ] Ruby exception occurred: undefined methodremove' for {"76561198447918001"=>0}:Hash`

BTW I'm using logstash-5.6.4

5

No, right, it's delete and not remove.

6

:sweat_smile: Testing...

7

It works.

ruby { code => "event.get('[field_with_keys]').keys.each { |k| event.get('field_with_keys').delete(k) }" }
mutate { remove_field => [ "field_with_keys" ] }

Thanks a mil!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.