Hi guys,
I've got the following problem:
Some of my events somehow get sent to logstash with a field consisiting of an empty name and an empty value ([records][conditions][""]). Of course Elasticsearch doesn't like this. Is there a way to delete all fields with an empty name ? I just think deleting all fields with an empty name would be safer, if this happens to another field. I allready looked into the prune filter. but the doc says its only for top level fields.
{
"records": {
"systemId": "XXXX",
"resourceId": "XXXX",
"time": "XXXX",
"operationName": "XXX",
"properties": {
"subnetPrefix": "XXXX",
"ruleName": "XXXX",
"type": "allow",
"primaryIPv4Address": "XXXX",
"macAddress": "XXXXX",
"conditions": {
"": "",
"destinationIP": "0.0.0.0/0",
"sourcePortRange": "0-65535",
"destinationPortRange": "0-65535"
},
"priority": 65001,
"direction": "In",
"vnetResourceGuid": "XXX",
"category": "XXX",
"@version": "1",
"resource_type_1": "XXX",
"resource_provider_namespace": "MICROSOFT.NETWORK",
"@timestamp": "XXX",
"logstash_instance": "XXX",
"customer": "XXX",
"resource_name_1": "XXX",
"subscription_id": "XXX",
"eventhub": "XXX",
"resource_group_name": "XXX"
}
}
}
Thanks in advance