# Removing null fields from nexted fields - xml filter

**URL:** https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747
**Category:** Logstash
**Created:** [July 29, 2016, 3:51pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747 "2016-07-29T15:51:33Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)
#### Post date: [July 29, 2016, 3:51pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/1 "2016-07-29T15:51:33Z")

</div>

im using the xml filter to parse xml with logstash. This places the xml info in a nested field, such as:  
[entry][xmlField1]  
[entry][xmlField2]

i am having issues with mappings and data when the fields are periodically null. I would like to try to remove the fields that are null, but the xml filter does not have anything which will do that (such as suppress\_empty).

the following ruby code does not dig into nested fields and my ruby experience is slightly above 0.  
ruby {  
code =\> "  
hash = event.to\_hash  
hash.each do |k,v|  
if v == nil  
event.remove(k)  
end  
end  
"  
}

Anyhow, im open to ideas.

---

<div class="post-metadata">

### Author: ![polyfractal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polyfractal/32/48162_2.png) [@polyfractal](https://discuss.elastic.co/u/polyfractal)
#### Post date: [July 29, 2016, 5:19pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/2 "2016-07-29T17:19:16Z")

</div>

Moving to logstash 🙂

---

<div class="post-metadata">

### Author: ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)
#### Post date: [July 29, 2016, 5:44pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/3 "2016-07-29T17:44:35Z")

</div>

indeed, sorry!

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 31, 2016, 12:05am UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/4 "2016-07-31T00:05:14Z")

</div>

I've used something like this before;

```auto
if [field] == "" {
    drop {}
  }

```

---

<div class="post-metadata">

### Author: ![whyapenny](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@whyapenny](https://discuss.elastic.co/u/whyapenny)
#### Post date: [August 1, 2016, 4:35pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/5 "2016-08-01T16:35:09Z")

</div>

> [@warkolm](#):
>
> if [field] == "" {  
> drop {}  
> }

Won't that drop the entire entry, as opposed to just the field that is null? I would still like to keep the rest of the data in the entry.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 1, 2016, 9:41pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/6 "2016-08-01T21:41:43Z")

</div>

Oh right, sorry.

Just `remove_field` then, with `mutate`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:45am UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747/7 "2017-07-06T04:45:28Z")

</div>