Removing parent object names with ingest pipeline

Elastic Stack Elasticsearch
1

I'm trying to figure out how to clean up my fields and remove some of the top level parents in my documents. I want to turn Properties.Status and Properties.Status.StatusName into Status and Status.StatusName, respectively.

With logstash this is done with a ruby filter that looks like:

            ruby {
                code => '
                    if (event.get("Properties"))
                        event.get("Properties").each { |j,p|
                            event.set(j,p);
                            }
                        event.remove("Properties");
                    end
                '
            }

But I need to do this with an ingest pipeline and I'm not as familiar with painless. Any help?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.