# Ruby filter to whitelist nested fields
**URL:** https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424
**Category:** Logstash
**Created:** [February 28, 2022, 3:43pm UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424 "2022-02-28T15:43:13Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@lordcosmos1978](https://discuss.elastic.co/u/lordcosmos1978)
#### Post date: [February 28, 2022, 3:43pm UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424/1 "2022-02-28T15:43:13Z")
I am trying to whitelist a number of nested fields.
I first tried it using the prune filter but it seems that one does not support nested fields only top level fields.
I saw in this topic [Logstash prune nested fields](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984) that there was an example for blacklisting nested fields using the ruby filter.
Can somebody help me with the same thing but for whitelisting ?
I tried to do it myself but ruby is very new for me so I am really struggling.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 28, 2022, 5:18pm UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424/2 "2022-02-28T17:18:53Z")
If you need to iterate over the contents of objects in the event then you would use a ruby filter like [this](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248/8). However, it is hard for me to even think of a syntax that would allow one to specify which nested fields should be whitelisted when an object can contain arrays within hashes and hashes within arrays.
---
### Author:  [@lordcosmos1978](https://discuss.elastic.co/u/lordcosmos1978)
#### Post date: [March 1, 2022, 9:48am UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424/3 "2022-03-01T09:48:27Z")
here is an example of the data structure.
as an example I would only like to keep var1,var2 and var3
`{ "events": { "var1": "aaa", "var2": "bbbb", "var3": true, "var4": "true", "time": 1646061099862, "var5": "tttt", "var6": "xxxxxxxxxxxx" } }`
So this is what I would like to keep after the whitelisting
`{ "events": { "var1": "aaa", "var2": "bbbb", "var3": true, } }`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2022, 9:49am UTC](https://discuss.elastic.co/t/ruby-filter-to-whitelist-nested-fields/298424/4 "2022-03-29T09:49:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.