Remove nested fields from parsed xml

Elastic Stack Logstash
1

Hi all,

I'm trying to remove some fields from an xml parsed document.
I got a lot of fields (~150), and I would like to delete some of them (~60), so I can't list them individually (and I don't know them in advance).
I saw prune filter can't work as it is nested fields, and i read solution seems to be with ruby code, but despite of many reads about this subject, I can't find the way to make it work. (total beginner in ruby).

Ideally, I would remove xmlns:SOAP-ENV field, and all xml_parsed.Body.PostItems.items subfields

Below filter I'm trying to deal with (does not works) :

 filter {

 xml {
            source => "message"
            target => "xml_parsed"
            force_array => false
            }


ruby
{
code => "
         event['xml_parsed'].keys.each { |k|
         event['xml_parsed'].delete(k) if k.start_with?('xmlns')
                }"

}

Below xml I play with :

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Header><ns:AuthenticationHeader xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns="urn:NWS:examples" xmlns:ns0="http://schemas.xmlsoap.org/soap/envelope/"><ns:Method>*</ns:Method><ns:Login>user@test.com</ns:Login><ns:Seed>aalap</ns:Seed><ns:Stamp>2020-04-24T05:36:50</ns:Stamp><ns:Signature>N1324564878925OVg==</ns:Signature></ns:AuthenticationHeader></SOAP-ENV:Header><SOAP-ENV:Body><ns0:PostItems xmlns:ns0="urn:NWS:examples"><ns0:items><ns0:InventoryItem><ns0:SKU>13456789</ns0:SKU><ns0:Quantity>0</ns0:Quantity></ns0:InventoryItem></ns0:items></ns0:PostItems></SOAP-ENV:Body></SOAP-ENV:Envelope>

Many thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.