Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

I have JSON file that I'm sending to ES through logstash. I would like to remove 1 field ( It's deep field ) in the JSON - ONLY if the value is NULL.

Part of the JSON is:

"input": {
        "startDate": "2015-05-27",
        "numberOfGuests": 1,
        "fileName": "null",
        "existingSessionId": "XXXXXXXXXXXXX",
        **"radius": "null",**
        "nextItemReference": "51",
        "longitude": -99.12,
        "endDate": "2015-05-29",
        "thumbnailHeight": 200,
        "thumbnailWidth": 300,
        "latitude": 19.42,
        "numOfRooms": "1"
Part in the logstash.conf file is :
if [input.radius] == "null" {
                mutate {
                        remove_field => [ "input.radius" ]
This is inside the filter of course.
How can I remove this field if the value is null?
Nested fields aren't referred with [name.subfield] but [field][subfield]. This should work for you:
if [input][radius] == "null" {
  mutate {
    remove_field => [ "[input][radius]" ]
Note that if there is no "input" field, the [input][radius] reference will create an empty "input" dictionary. To avoid that you can do this:
if [input] and [input][radius] == "null" {
  mutate {
    remove_field => [ "[input][radius]" ]
See the Logstash documentation for details and more examples.
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.