Working with child fields

ronwest99 · May 18, 2016, 3:16pm

My log looks something like this.
"request": {
"hostip": "10.7.37.74",
"enduserip": "",
}

Obviously "enduserip": "" is not a valid IP address. I would like to delete the field in this case.

This syntax isn't being considered valid by logstash.
mutate{
remove_field => ["request"]["enduserip"]
}

Any suggestions?

magnusbaeck · May 18, 2016, 8:40pm

mutate {
  remove_field => ["[request][enduserip]"]
}

ronwest99 · May 18, 2016, 10:06pm

That worked, thanks!

Does the same syntax hold true for renaming a child field?

(my google foo on these topic's is highly lacking)

magnusbaeck · May 19, 2016, 5:35am

Yes.