chimbu3306
(chimbu chinnadurai)
August 19, 2019, 1:02pm
1
I have a json where i need to remove a field using mutate or any other filter,
{
"clientUserAgent": null,
"environment": "Logs_0z9uc0nzlh/qa",
"timestamp": 1566220446505,
"sequence": 3,
"payload": {
"message": "(39087291-c283-11e9-943a-b9a377a9da4d) Endpoint request body after transformations: {\"type\":\"TOKEN\",\"methodArn\":\"arn:aws:execute-api:eu-west-1:/PUT/v2/en\",\"authorizationToken\":\"eyJhbGciOiJIUzI1NiJ9\"}"
},
"@version": "1",
"@timestamp": "2019-08-19T13:14:06.505Z"
}
I have tried using the mutate filter to remove the filed authorizationToken and below is my filter, but it is not working as expected
filter {
mutate { remove_field => [ "[payload][message][authorizationToken]"]
}
}
Can anyone give me an idea about how to get rid of the authorizationToken field in the json?
Badger
August 19, 2019, 1:28pm
2
[payload][message][authorizationToken] does not exist. [payload][message] is a string. Try
mutate { gsub => [ "message", ',"authorizationToken":"[^"]+"', "" ] }
chimbu3306
(chimbu chinnadurai)
August 19, 2019, 2:21pm
3
Thanks Badger, I tried this one but its not removing authorizationToken. Its returns the same input as output. The message part actually looks like this
{
"clientUserAgent": null,
"environment": "Logs_0z9uc0nzlh/qa",
"timestamp": 1566220446505,
"sequence": 3,
"payload": {
"message": "(39087291-c283-11e9-943a-b9a377a9da4d) Endpoint request body after transformations: {\"type\":\"TOKEN\",\"methodArn\":\"arn:aws:execute-api:eu-west-1:/PUT/v2/en\",\"authorizationToken\":\"eyJhbGciOiJIUzI1NiJ9\"}"
},
"@version": "1",
"@timestamp": "2019-08-19T13:14:06.505Z"
}
Badger
August 19, 2019, 3:05pm
4
Sorry, I meant
mutate { gsub => [ "[payload][message]", ',"authorizationToken":"[^"]+"', "" ] }
chimbu3306
(chimbu chinnadurai)
August 23, 2019, 2:56pm
5
Thanks Badger.its working as expected
system
(system)
Closed
September 20, 2019, 2:57pm
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.