Remove multiple similar prefix events from a json variable

How can I remove multiple events from a json variable with a prefix such as "customer_" ?
I have used the json plugin to pull the data into a variable

json { source => "message" target => "[@metadata][json]" }

Now i am attempting to remove all of the events that start with "customer_"

I was attempting to use the ruby plugin

	code =>
	"event.get('[@metadata][json]').to_hash.keys.each { |k| if k.start_with?('customer_') then event.remove('[@metadata][json][k]') end }"

Use string interpolation

ruby { code => 'event.get("[@metadata][json]").to_hash.keys.each { |k| if k.start_with?("customer_") then event.remove("[@metadata][json][#{k}]") end }' }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.