Removing null fields from nexted fields - xml filter

Elastic Stack Logstash
1

im using the xml filter to parse xml with logstash. This places the xml info in a nested field, such as:
[entry][xmlField1]
[entry][xmlField2]

i am having issues with mappings and data when the fields are periodically null. I would like to try to remove the fields that are null, but the xml filter does not have anything which will do that (such as suppress_empty).

the following ruby code does not dig into nested fields and my ruby experience is slightly above 0.
ruby {
code => "
hash = event.to_hash
hash.each do |k,v|
if v == nil
event.remove(k)
end
end
"
}

Anyhow, im open to ideas.

2

Moving to logstash :slight_smile:

3

indeed, sorry!

4

I've used something like this before;

if [field] == "" {
    drop {}
  }
5

Won't that drop the entire entry, as opposed to just the field that is null? I would still like to keep the rest of the data in the entry.

6

Oh right, sorry.

Just remove_field then, with mutate.