Remove spaces from field names after JSON parsing from filebeat

[nmoham (Naveed)]

Sample data

{ "time": "2020-06-11 01:59:16.9760 -05:00", "level": "Info", "threadId": "164", "Message": "GetContactDataForCustomAutoAssignWorker", "Message": "Completed", "Call Tracker Id": "7e6a1602-6a89-4933-9329-d1736221cee4", "AccountId": 4225, "Request ContactRecordId greater than": 1083689804, "Request Page Size": 10000, "Request CampaignDefCriteriaId": 1819, "Request HasCorrelatedCriteria": true, "Request HasMilestones": false, "Request UserOptIn": true }
used the following settings in Filebeat -

json.keys_under_root: true
json.add_error_key: true

Works fine to breakdown the fields. But I am trying to remove spaces between the field names, couldn't figure out a way to do it in filebeat itself.

How to do it in logstash for all the fields received after JSON processing from Filebeat ? Any ideas would help.

Thanks

[Jenni]

I can't test it right now, but the ruby code for that should be something like this (if all fields are at root level. Otherwise we'll have to do this recursively for the the subfields as well):

event.to_hash.each { |k, v|
    event.remove(k)
    event.set(k.gsub(' ', ''), v)
}

[nmoham (Naveed)]

That worked perfectly.

ruby code -

 filter
{

  if [name] == "newlogs"
        {

        ruby {
        code => "
        event.to_hash.each { |k, v|
        event.remove(k)
        event.set(k.gsub(' ', ''), v)
                } "
        }
   }
}

Great Thanks @Jenni