0

I have a log line which contains json data, I am applying the json filter and then mutate to parse it.

What I need to do is

Loop through each parsejson field If the value the field contains is "%{[parsedjson]" + fieldname itself remove it.

For example ( Replaced actual data with dummy data )

if the field [studentName] contains ""%{[parsedjson][studentName]}" , it means that this field needs to be removed.

This is how I'm doing it right now, pretty horrible

json{
            source=>"jsondata"
            target=>"parsedjson"

        }       

mutate{ 


.... #adding removing fields, not important

#manually removing all fields
    if [studentName]=="%{[parsedjson][studentName]}"
            {
                mutate{     
                    remove_field=>["studentName"]
            }       
        }

    if [studentAge]=="%{[parsedjson][studentAge]}"
                {
                    mutate{     
                        remove_field=>["studentAge"]
                }       
        }

My ruby skills leave a lot to be desired, any help greatly appreciated :)

bingbon
  • 123
  • 1
  • 2
  • 7

1 Answers1

0

This answer shows how to loop across all the fields in ruby and how to remove a field.

Community
  • 1
  • 1
Alain Collins
  • 16,268
  • 2
  • 32
  • 55