Rename a field that has variable in name

Elastic Stack Logstash
1

What would be the best way to remove a nested field that has a variable in its name?

For example, the logs I'm parsing as json

{
  "foo": {
    "bar(987234)": "derp"
  }
}

Represented as nested field

[foo][bar(2349871)]

I want to strip out the random numbers.

[foo][bar]

I'm ok to throw the numbers away, but I'd like to preserve them if possible.

Here is what I've tried.

  mutate {
    rename => { "[foo][bar*]" => "[foo][bar]" }
  }

or

  mutate {
    rename => { "[foo][bar%{*}]" => "[foo][bar]" }
  }

or

  mutate {
    rename => { "[foo][bar(*)]" => "[foo][bar]" }
  }

From the documentation it appears that these should work.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split

2

You'll have to use a ruby filter for this. Iterate over the keys in event['foo'], see if they match somestring(somenumber) and if so add a new hash with just somestring as the key and delete the old entry.

From the documentation it appears that these should work.

Where does the documentation indicate that wildcards are supported?