Unable to remove the field


(soujanya) #1

Hi all,
I'm new to the Kibana. I'm trying to remove the field based on some condition. But not getting how to do..
I've used the below code.

filter {
grok {
break_on_match => false
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}] %{LOGLEVEL:loglevel} %{GREEDYDATA:log}|%{GREEDYDATA:log1}"}
}
if[log] =~ "(?i) applicable" {
grok{
remove_field => ["log"]
}
}
}

If log contains keyword "applicable", log field has to be removed furtherly.Please anyone help me out in resolving the issue. Any help would greatly appreciated.

Thank you in advance.


(Magnus B├Ąck) #2
if[log] =~ "(?i) applicable" {

As documented, the correct syntax is:

if [log] =~ /(?i) applicable/ {

Secondly, the grok filter's remove_field option will only fire when the grok filter is successful, and it never is because you're not supplying any expressions to match against. Use the mutate filter instead:

mutate {
  remove_field => ["log"]
}

(system) #3