# Remove spaces from field names after JSON parsing from filebeat

**URL:** <https://discuss.elastic.co/t/remove-spaces-from-field-names-after-json-parsing-from-filebeat/236806>\
**Category:** Logstash\
**Created:** [June 12, 2020, 2:07am UTC](https://discuss.elastic.co/t/remove-spaces-from-field-names-after-json-parsing-from-filebeat/236806 "2020-06-12T02:07:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)\
**Post date:** [June 12, 2020, 2:07am UTC](https://discuss.elastic.co/t/remove-spaces-from-field-names-after-json-parsing-from-filebeat/236806/1 "2020-06-12T02:07:19Z")

</div>

Sample data

`{ "time": "2020-06-11 01:59:16.9760 -05:00", "level": "Info", "threadId": "164", "Message": "GetContactDataForCustomAutoAssignWorker", "Message": "Completed", "Call Tracker Id": "7e6a1602-6a89-4933-9329-d1736221cee4", "AccountId": 4225, "Request ContactRecordId greater than": 1083689804, "Request Page Size": 10000, "Request CampaignDefCriteriaId": 1819, "Request HasCorrelatedCriteria": true, "Request HasMilestones": false, "Request UserOptIn": true } `  
used the following settings in Filebeat -

json.keys\_under\_root: true  
json.add\_error\_key: true

Works fine to breakdown the fields. But I am trying to remove spaces between the field names, couldn't figure out a way to do it in filebeat itself.

How to do it in logstash for all the fields received after JSON processing from Filebeat ? Any ideas would help.

Thanks

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 12, 2020, 2:02pm UTC](https://discuss.elastic.co/t/remove-spaces-from-field-names-after-json-parsing-from-filebeat/236806/2 "2020-06-12T14:02:12Z")

</div>

I can't test it right now, but the ruby code for that should be something like this (if all fields are at root level. Otherwise we'll have to do this recursively for the the subfields as well):

```
event.to_hash.each { |k, v|
    event.remove(k)
    event.set(k.gsub(' ', ''), v)
}
```

---

<div class="post-metadata">

**Author:** ![nmoham](https://avatars.discourse-cdn.com/v4/letter/n/77aa72/32.png) [@nmoham](https://discuss.elastic.co/u/nmoham)\
**Post date:** [June 14, 2020, 11:14pm UTC](https://discuss.elastic.co/t/remove-spaces-from-field-names-after-json-parsing-from-filebeat/236806/3 "2020-06-14T23:14:41Z")

</div>

That worked perfectly.

ruby code -

```auto
 filter
{

  if [name] == "newlogs"
        {

        ruby {
        code => "
        event.to_hash.each { |k, v|
        event.remove(k)
        event.set(k.gsub(' ', ''), v)
                } "
        }
   }
}

```

Great Thanks @Jenni

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2020, 11:14pm UTC](https://discuss.elastic.co/t/remove-spaces-from-field-names-after-json-parsing-from-filebeat/236806/4 "2020-07-12T23:14:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.