Remove array field if empty

Question

Please suggest how to remove array field if empty? I have tried below config :

if [tags] == [] {
mutate {
remove_field => ["tags"]
}
}

But getting logstash exception:
[2018-03-01T15:07:56,000][FATAL][logstash.runner ] The given configuration is invalid. Reason: Failed to parse right-hand side of conditional [str]pipeline:31:8:[tags] == []

i need this in logstash. link suggests to do in elasticsearch. pls suggest — khaja mohiddin
– khaja mohiddin, Commented Mar 1, 2018 at 10:24
I think you'll have to use the ruby filter, I haven't seen a way to do it otherwise. — baudsp
– baudsp, Commented Mar 1, 2018 at 13:48
with ruby code i am not able to check if array is empty and delete it. if found a method empty? in ruby but not working with logstash ruby filter. pls help with ruby code snippet any.] — khaja mohiddin
– khaja mohiddin, Commented Mar 1, 2018 at 13:56

Daniel Rose · Accepted Answer · 2019-03-29 12:25:36Z

4

I didn't know how to remove a field from inside the ruby filter, so when the tags array is empty, I'm setting another field and using to know when to remove the field tags.

ruby {
    code => "event.set('[is_tags_empty]', 'true') if event.get('[tags]').length == 0"
}

if [is_tags_empty] {
    mutate {
        remove_field => ["tags","is_tags_empty"]
    }
}

edited Mar 29, 2019 at 12:25

Daniel Rose

17.8k9 gold badges72 silver badges94 bronze badges

answered Mar 1, 2018 at 14:01

baudsp

4,1091 gold badge20 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

khaja mohiddin Over a year ago

it worked..! thanks alot. :) whats event.set event.get over here ? i think its pure ruby program wrapped with double quotes inside code block of ruby filter. am i correct?

baudsp Over a year ago

This event.set('[is_tags_empty]', 'true') if event.get('[tags]').length == 0 is the ruby program. event.get('[tags]') retrieve the field tags from the event, event.set('[is_tags_empty]', 'true') set the field is_tags_empty in the event to the value true.

baudsp Over a year ago

For more information about the event, see elastic.co/guide/en/logstash/current/event-api.html

Thiago Falcao · Accepted Answer · 2019-07-30 18:20:53Z

1

Check for not null and if array is empty

if [tags] and !([tags][0]) {
    mutate {
        remove_field => ["tags"]
    }
}

Tested on Logstash 7.1

edited Jul 30, 2019 at 18:20

answered Jul 25, 2019 at 17:51

Thiago Falcao

5,1131 gold badge43 silver badges35 bronze badges

Comments

Rahul Singhai · Accepted Answer · 2019-04-12 21:16:09Z

0

This one worked for me:

ruby {
  code => "if event.get('tags').length == 0 then event.remove('tags') end"
}

answered Apr 12, 2019 at 21:16

Rahul Singhai

1,35915 silver badges29 bronze badges

Collectives™ on Stack Overflow

Remove array field if empty

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related