Removing and renaming subsubfield with ruby code

Elastic Stack Logstash
1

Hi,
I am trying to remove all the data_type subsubfield from an JSON array that looks like :
"doc": {
"subdoc1": {
"content": "valuex"
"data_type": "valuey"
},
"subdoc2": {
"content": "value2"
"data_type": "valuey"

i used the mutate filter to remove_fields all that data_type fields :
remove_field => "[doc][subdoc1][data_type]"
remove_field => "[doc][subdoc2][data_type]"
...
Problem is that doc document contains 100 subdoc value...

Is it possible to do it easier, like with a ruby code filter ?

Last thing, is that i would like to rename all the remaining fields doc.subdocX.content to the top level field subdocX, [doc][subdoc1][content] => [subdoc1]

I would like avoid the mutate rename that force me to write the 100 rules for each subdocX field, and replace it with a ruby code filter.
I am using LS5.4 with the new Event API.

Thanks in advance.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.