CODEWITHSUNDEEP
jsonlogstashlogstash-configuration
Pooja
Pooja

Reputation: 883

kv filter in logstash

How does remove_field in kv work? I have a json file and need to remove fields that are deeply nested in the json file.

[url][queryString][404;http://hspb.homesearch.com:80/wcJV4LhTSmzJ1rX6FOq4RuiKe K49gUP2JvWtjdhhE] is one such field

This filter doesn't work in logstash

 filter {
   kv {
      source => [ "[url][queryString]" ]
      remove_field => [ "404;%{somefield}" "my_extraneous_field" ]
    }
  }

Upvotes: 0

Views: 1028

Answers (1)

Alain Collins
Alain Collins

Reputation: 16362

remove_field will remove the named field(s) when the underlying filter (in your case 'kv') succeeds.

If you need to refer to nested fields, try "[foo][bar]". You can test if you can use fields in the variable names...

NOTE: [foo][bar] is meant to illustrate how to refer to nested fields. If your fields are [myTopField][myNestedField], use that.

Upvotes: 1

Related Questions