Configuring Logstash to only include certain fields

Question

Using filter , mutate , and remove_field , Logstash con be configured to exclude certain fields from the output.

But what if one only knows the names of the fields to be included, and wants to exclude all other fields (the names of which one did not know up front). How could this be done?

Thanks

Answer 1

You can use a ruby filter :

filter {
  ruby {
    code => "
      wanted_fields = ['message', 'foo']
      event.to_hash.keys.each { |k|
        event.remove(k) unless wanted_fields.include? k
      }
    "
  }
}

Related:

• Remove Field from event by pattern