Remove Subfield using ruby

Anyone knows how to remove the attachment.documentcharacteristic field? using logstash ruby.

Here the json data

image

Why not use

mutate { remove_field => [ "[attachment][0][documentCharacteristic]" ] }

but if you insist...

ruby { code => 'event.remove("[attachment][0][documentCharacteristic]")' }
1 Like

hi thank yo for reply, but i need to remove not only at index 0 but unto all

This is what the schema looks like

attachments : [
	{
		field1 : "sasas",
		documentCharacteristic : [
			name:value
		]
	},
	{
		field1 : "asa",
		documentCharacteristic : [
			name:value
		]
	},
	{
		field1 : "fdgee",
		documentCharacteristic : [
			name:value
		]
	}
	.
	.
	.
	.
	.
	.
	etc
]

i want it to be like this

attachments : [
	{
		field1 : "sasas"
	},
	{
		field1 : "asa"
	},
	{
		field1 : "fdgee"
	}
	.
	.
	.
	etc
]

Hi badger thank you, but i tweak a little

            ruby { code => '
                    event.get("attachment").each_with_index { |b,index|
                            event.remove("[attachment][#{index}][documentCharacteristic]")
                    }
                    '
            }