Using Prune Filter To Remove Null Value Fields

[wwalker (Walker)]

I am using the JSON filter to parse out events. However, many fields are frequently blank. I'd like to remove those fields without having to manually specify if blank then use mutate to remove field dozens of times. It looks like the prune filter would work for me but I wanted to double-check before I implement. Is the below config all I would need to accomplish this?

prune {
  blacklist_values => [ "" ]
}

[Badger]

No, blacklist_values takes a hash, each member of which is a field name and a regexp used to determine whether to remove the field. You can do it in ruby

    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v.kind_of? String
                    if v == ""
                        event.remove(k)
                    end
                end
            }
        '
    }

[wwalker (Walker)]

Gotcha....that's a weird syntax that prune is using, or at least different from what I've seen other hash values look like.

Regarding the ruby code you entered, does the string event.to_hash.each need to be changed or am I copy/pasting exactly what you have into my pipeline?

[Badger]

If you are removing fields from the top-level then it will work as is.