I have a log line which contains json data, I am applying the json filter and then mutate to parse it.
What I need to do is
Loop through each parsejson field If the value the field contains is "%{[parsedjson]" + fieldname itself remove it.
For example ( Replaced actual data with dummy data )
if the field [studentName
] contains ""%{[parsedjson][studentName]}"
, it means that this field needs to be removed.
This is how I'm doing it right now, pretty horrible
json{
source=>"jsondata"
target=>"parsedjson"
}
mutate{
.... #adding removing fields, not important
#manually removing all fields
if [studentName]=="%{[parsedjson][studentName]}"
{
mutate{
remove_field=>["studentName"]
}
}
if [studentAge]=="%{[parsedjson][studentAge]}"
{
mutate{
remove_field=>["studentAge"]
}
}
My ruby skills leave a lot to be desired, any help greatly appreciated :)