Trying to add ruby filter to remove leading zero

[paano]

I have the following the json message.

{

"eventData" : {
"commandContext" : {
  "eventUserId" : "system",
  "eventOrigin" : "java",
  "eventQueueMgr" : "TEST1",
  "eventAccountingToken" : 0000000000000000000000000000000000000000000000000000000000000000,
  "eventApplIdentity" : "",
  "eventApplType" : "Unix",
  "eventApplName" : "aixutil",
  "eventApplOrigin" : "",
  "command" : "Inquire"
}
}
}

Trying to remove the leading zero as logstash is throwing error. Cannot adjust the source.

I am trying to achieve this by adding a ruby filter to replace the 0 to ' '.
Need some assistance on how to write the script.

logstash conf is -

filter {

			ruby {
			    code => "str.sub!([eventData][commandContext][eventAccountingToken], "")"
			}

			json {
						source => "message"
				}
}

[Badger]

@paano

[eventData][commandContext][eventAccountingToken]

The JSON has not been parsed when the ruby filter executes, so that field does not exist at that point. You can remove leading zeroes from fields using

mutate { gsub => [ "message", " 0*([0-9]+),", " \1," ] }

[paano]

@Badger it works.
IF i would use ruby filter, how would i implement. I am trying to learn using rubyfilter. ANy suggestion

[Badger]

ruby { code => ' event.set("message", event.get("message").gsub(/ 0*([0-9]+),/, " \\1,")) ' }

[paano]

@Badger if i had to remove the field completely before the json parse. is there a way in logstash. And also convert field to string in gsub.

[Badger]

You could use mutate+gsub to remove eventAccountingToken from the message before parsing.

If you want to convert the field to a string use mutate+convert.