delete_key

Learn about the delete_key OTTL editor function.

  2 minute read  

Overview

This function is used to remove a specified key and its associated value from a target field or object within a log entry. It is useful for cleaning up logs by eliminating unnecessary or sensitive information. If a batch of keys need to be deleted in a single operation you can either delete them using a regex pattern delete_matching_keys or, if no regex pattern covers them all, use the Edge Delta extension function edx_delete_keys.

Syntax

delete_key(target, key)

  • Target: The target refers to the field containing the key you want to delete. It is typically a parent container, such as a JSON object or an associative array, which holds multiple key-value pairs.
  • Key: The key is the specific identifier within the target that you wish to delete. It refers to the name of the field entry that you intend to remove, along with its associated value.

Examples

Input

{
  "_type": "log"
  "body": "..."
  "resource": {
    "container.id": "123456789"
    "container.image.name": "docker.io/edgedelta/loggen:latest"
    "ed.conf.id": "123456789"
    "ed.domain": "pipeline"
    "ed.filepath": "/var/log/pods/loggenlogs_loggen-123456789/loggen/0.log"
    "ed.org.id": "987654321"
    "ed.source.name": "Kubernetes Source"
    "ed.source.type": "kubernetes_input"
    "ed.tag": "loggen"
    "host.ip": "172.18.0.5"
    "host.name": "loggencluster-worker2"
    "k8s.container.name": "loggen"
    "k8s.deployment.name": "loggen"
    "k8s.namespace.name": "loggenlogs"
    "k8s.node.name": "loggencluster-worker2"
    "k8s.pod.name": "loggen-7cc748d75-xh8lq"
    "k8s.pod.uid": "123456789"
    "k8s.replicaset.name": "loggen-7cc748d75"
    "service.name": "loggen"
    "src_type": "K8s"
  }
  "timestamp": 1733369799254
}

Statement

delete_key(resource, "service.name")

Output

{
  "_type": "log"
  "body": "..."
  "resource": {
    "container.id": "123456789"
    "container.image.name": "docker.io/edgedelta/loggen:latest"
    "ed.conf.id": "123456789"
    "ed.domain": "pipeline"
    "ed.filepath": "/var/log/pods/loggenlogs_loggen-123456789/loggen/0.log"
    "ed.org.id": "987654321"
    "ed.source.name": "Kubernetes Source"
    "ed.source.type": "kubernetes_input"
    "ed.tag": "loggen"
    "host.ip": "172.18.0.5"
    "host.name": "loggencluster-worker2"
    "k8s.container.name": "loggen"
    "k8s.deployment.name": "loggen"
    "k8s.namespace.name": "loggenlogs"
    "k8s.node.name": "loggencluster-worker2"
    "k8s.pod.name": "loggen-7cc748d75-xh8lq"
    "k8s.pod.uid": "123456789"
    "k8s.replicaset.name": "loggen-7cc748d75"
    "src_type": "K8s"
  }
  "timestamp": 1733369799254
}

The log entry is modified to exclude the service.name field from resource, leaving the remaining entries in the resource object.

Delete from body

The delete_key function can remove keys from parsed JSON body fields.

Input

{
	"_type": "log",
	"body": {
		"message": "ERROR: Connection to db-primary-west failed",
		"temp_field": "deleteme",
		"status": "active"
	},
	"resource": {...},
	"attributes": {}
}

Statement

delete_key(body, "temp_field")

Output

{
	"_type": "log",
	"body": {
		"message": "ERROR: Connection to db-primary-west failed",
		"status": "active"
	},
	"resource": {...},
	"attributes": {}
}

The temp_field key and its value were removed from the body object.