Logstash字段名称以

Question

For example i have the following JSON:

{
  params{
    firstname : value1,
    .lastname : value2
  }
}

How can i check if the name of a field (not the value) start with "." and delete it?

BR

Answer 1

If your are using the json filter to parse the json you can use the mutate filter with gsub to remove all the "." before using the json filter. But only if you are sure the dots are only in the beginning of the field names.

It would look like this :

# Removing all the dots from the field message
mutate {
    gsub => ["message", "\.", ""]
}

json {
    source => "message"
}    

---

There is an alternative, which is the de_dot filter. You'll have to install it and it is apparently expensive ressource-wise.

de_dot filter documentation