Remove Subfield using ruby

Elastic Stack Logstash
1

Anyone knows how to remove the attachment.documentcharacteristic field? using logstash ruby.

Here the json data

image

2

Why not use

mutate { remove_field => [ "[attachment][0][documentCharacteristic]" ] }

but if you insist...

ruby { code => 'event.remove("[attachment][0][documentCharacteristic]")' }
1 Like
3

hi thank yo for reply, but i need to remove not only at index 0 but unto all

This is what the schema looks like

attachments : [
	{
		field1 : "sasas",
		documentCharacteristic : [
			name:value
		]
	},
	{
		field1 : "asa",
		documentCharacteristic : [
			name:value
		]
	},
	{
		field1 : "fdgee",
		documentCharacteristic : [
			name:value
		]
	}
	.
	.
	.
	.
	.
	.
	etc
]

i want it to be like this

attachments : [
	{
		field1 : "sasas"
	},
	{
		field1 : "asa"
	},
	{
		field1 : "fdgee"
	}
	.
	.
	.
	etc
]
4

Hi badger thank you, but i tweak a little

            ruby { code => '
                    event.get("attachments").each_with_index { |b,index|
                            event.remove("[attachments][#{index}][documentCharacteristic]")
                    }
                    '
            }
5

@inhinyera16 Did this work for you? Shouldn't that be attachments and not attachment and even after that my output does not seem to be correct.

6

Oh yeah, typo mistake. Already corrected it.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.