Anyone knows how to remove the attachment.documentcharacteristic field? using logstash ruby.
Here the json data
Anyone knows how to remove the attachment.documentcharacteristic field? using logstash ruby.
Here the json data
Why not use
mutate { remove_field => [ "[attachment][0][documentCharacteristic]" ] }
but if you insist...
ruby { code => 'event.remove("[attachment][0][documentCharacteristic]")' }
hi thank yo for reply, but i need to remove not only at index 0 but unto all
This is what the schema looks like
attachments : [
{
field1 : "sasas",
documentCharacteristic : [
name:value
]
},
{
field1 : "asa",
documentCharacteristic : [
name:value
]
},
{
field1 : "fdgee",
documentCharacteristic : [
name:value
]
}
.
.
.
.
.
.
etc
]
i want it to be like this
attachments : [
{
field1 : "sasas"
},
{
field1 : "asa"
},
{
field1 : "fdgee"
}
.
.
.
etc
]
Hi badger thank you, but i tweak a little
ruby { code => '
event.get("attachments").each_with_index { |b,index|
event.remove("[attachments][#{index}][documentCharacteristic]")
}
'
}
@inhinyera16 Did this work for you? Shouldn't that be attachments
and not attachment
and even after that my output does not seem to be correct.
Oh yeah, typo mistake. Already corrected it.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.