Removing nested keys using ruby filtering

i have an index with a lot of spam fields (over 300). they are all nested and look like this:


so i wanted to do filtering and use remove_fields to get rid of them.
wanted to use the prune filter but i can't - they don't support nested key removal.
and i can't use
filter {
mutate {

because it doesnt support regex.

i saw that the only way is through ruby filtering:

  ruby {
    code => "
    event.to_hash.keys.each { |k|
    if k.start_with?('[kv.amp-1][k]')

but it doens't work. i just need an example of deletion of nested keys using the ruby filter(no need for regex because start_with? is good enough)

using logstash 5.4.2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.