Ruby filter to modify nested json field failing

Elastic Stack Logstash
1

Hi,

I have never used ruby before, or logstash.

i have been trying to modify nested JSON field using ruby. JSON looks like below.

{ "a" : { "b" : "c=d; e=f; g=h" }

My end goal is to remove e=f from the nested key b. But to reach that, my first step was to see if i can replace or even access the field "a". but logger.info doesn't seem to print anything.

filter {
    ruby {
        code => "
           logger.info(event.get("[a]")
        "
    }
}

Somethings i tried..

filter {
  ruby {
    code => '
      bField = event.get("[a][b]")
      if bField
        bField.gsub!("e=[^;]+;?", "")  # Replace e=f; field and its value along with trailing semicolon if any
        event.set("[a][b]", bField)
      end
    '
  }
}

Any help is very much appreciated

2

There are several changes here

input { generator { count => 1 lines => [ '{ "a" : { "b" : "c=d; e=f; g=h" } }' ] codec => json } }

output { stdout { codec => rubydebug { metadata => false } } }
filter {
    mutate { remove_field => [ "event", "host", "log" ] }

    ruby {
        code => '
           logger.info(event.get("[a]").to_s)
        '
    }
    ruby {
        code => '
            bField = event.get("[a][b]")
            if bField
                bField = bField.sub(/e=[^;]+;?/, "")  # Replace e=f; field and its value along with trailing semicolon if any
                event.set("[a][b]", bField)
            end
        '
    }
}

will produce

[2024-04-10T12:34:44,347][INFO ][logstash.filters.ruby    ][main][63456446ae6b8cb04b40b83b5f63d3cb9ea7285a9839ed04258565074977ed3e] {"b"=>"c=d; e=f; g=h"}
{
         "a" => {
    "b" => "c=d;  g=h"
},
"@timestamp" => 2024-04-10T16:34:44.245990419Z,
  "@version" => "1"
}