# Removing nested keys using ruby filtering

**URL:** https://discuss.elastic.co/t/removing-nested-keys-using-ruby-filtering/145511
**Category:** Logstash
**Created:** [August 22, 2018, 7:53am UTC](https://discuss.elastic.co/t/removing-nested-keys-using-ruby-filtering/145511 "2018-08-22T07:53:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Arnold\_Yahad](https://avatars.discourse-cdn.com/v4/letter/a/5f8ce5/32.png) [@Arnold\_Yahad](https://discuss.elastic.co/u/Arnold_Yahad)
#### Post date: [August 22, 2018, 7:53am UTC](https://discuss.elastic.co/t/removing-nested-keys-using-ruby-filtering/145511/1 "2018-08-22T07:53:24Z")

</div>

i have an index with a lot of spam fields (over 300). they are all nested and look like this:

```
kv.amp-1-234
kv.amp-1-abc
kv.amp-1-efg

```

so i wanted to do filtering and use remove\_fields to get rid of them.  
wanted to use the prune filter but i can't - they don't support nested key removal.  
and i can't use  
filter {  
mutate {  
remove\_fields

because it doesnt support regex.

i saw that the only way is through ruby filtering:

```
  ruby {
    code => "
    event.to_hash.keys.each { |k|
    if k.start_with?('[kv.amp-1][k]')
      event.remove(k)
    end
    }
   "
   }

```

but it doens't work. i just need an example of deletion of nested keys using the ruby filter(no need for regex because start\_with? is good enough)

using `logstash 5.4.2`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 19, 2018, 7:53am UTC](https://discuss.elastic.co/t/removing-nested-keys-using-ruby-filtering/145511/2 "2018-09-19T07:53:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.