CODEWITHSUNDEEP
elasticsearchlogstash
Manya Goyal
Manya Goyal

Reputation: 33

Not able to remove all fields with a prefix in Logstash

I have following fields after I have parsed my JSON in Logstash.

parsedcontent.userinfo.appId
parsedcontent.userinfo.deviceId
parsedcontent.userinfo.id
parsedcontent.userinfo.token
parsedcontent.userinfo.type.

I want to remove all these fields using a filter. I can do it with :

filter{
  mutate{
     remove_field => "[parsedcontent][userinfo][appId]"
  }
}

But I have to write field names with same prefix many times and I have many such kind of fields. Is there any filter to remove fields with a prefix easily? Please guide.

Upvotes: 0

Views: 614

Answers (1)

Ansaldos
Ansaldos

Reputation: 308

You can use wildcards or regex.

filter {
    mutate {
        remove_field => "[parsedcontent*]"
    }
}

Upvotes: -1

Related Questions