# To exclude around 350 fields in JSON in Logstash

**URL:** <https://discuss.elastic.co/t/to-exclude-around-350-fields-in-json-in-logstash/239019>\
**Category:** Logstash\
**Created:** [June 28, 2020, 2:29pm UTC](https://discuss.elastic.co/t/to-exclude-around-350-fields-in-json-in-logstash/239019 "2020-06-28T14:29:01Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 28, 2020, 9:50pm UTC](https://discuss.elastic.co/t/to-exclude-around-350-fields-in-json-in-logstash/239019/6 "2020-06-28T21:50:28Z")

</div>

OK, you will need to a ruby script that iterates over the event and makes recursive calls to itself for each hash and array that it finds. I have failed to write that a few times over the years, but to-day I got around to it...

Create a file called removeKeys.rb that contains

```auto
def register(params)
    @field = params['keys']
end

def removeKeys(object, name, keys, event)
#puts "removeKeys called for #{name}"
    if object
        if object.kind_of?(Hash) and object != {}
            object.each { |k, v| removeKeys(v, "#{name}[#{k}]", keys, event) }
        elsif object.kind_of?(Array) and object != []
            object.each_index { |i|
                removeKeys(object[i], "#{name}[#{i}]", keys, event)
            }
        else
            lastElement = name.gsub(/^.*\[/, "").gsub(/\]$/, "")
            if keys.include? lastElement
#puts "removing #{name}"
            event.remove(name)
            end
        end
    end
end

def filter(event)
    event.to_hash.each { |k, v|
            removeKeys(v, "[#{k}]", @field, event)
    }
    [event]
end

```

Then call it using

```
    ruby {
        path => "/home/user/removeKeys.rb"
        script_params => { keys => "events_url" }
    }

```

Note that keys can be an array

```
        script_params => { keys => ["events_url", "comments"] }

```

You probably need some error checking in the ruby code (you will know you do when logstash crashes) and my apologies if my ruby coding style makes your eyeballs bleed.

---

_[View the full topic](https://discuss.elastic.co/t/to-exclude-around-350-fields-in-json-in-logstash/239019)._