delete_key

Learn about the delete_key OTTL editor function.

  2 minute read  

This function is used to remove a specified key and its associated value from a target field or object within a log entry. It is useful for cleaning up logs by eliminating unnecessary or sensitive information. If a batch of keys need to be deleted in a single operation you can either delete them using a regex pattern delete_matching_keys or, if no regex pattern covers them all, use the Edge Delta extension function edx_delete_keys.

Syntax: delete_key(target, key)

  • Target: The target refers to the field containing the key you want to delete. It is typically a parent container, such as a JSON object or an associative array, which holds multiple key-value pairs.
  • Key: The key is the specific identifier within the target that you wish to delete. It refers to the name of the field entry that you intend to remove, along with its associated value.

Input

{
  "_type": "log"
  "body": "..."
  "resource": {
    "container.id": "123456789"
    "container.image.name": "docker.io/edgedelta/loggen:latest"
    "ed.conf.id": "123456789"
    "ed.domain": "pipeline"
    "ed.filepath": "/var/log/pods/loggenlogs_loggen-123456789/loggen/0.log"
    "ed.org.id": "987654321"
    "ed.source.name": "Kubernetes Source"
    "ed.source.type": "kubernetes_input"
    "ed.tag": "loggen"
    "host.ip": "172.18.0.5"
    "host.name": "loggencluster-worker2"
    "k8s.container.name": "loggen"
    "k8s.deployment.name": "loggen"
    "k8s.namespace.name": "loggenlogs"
    "k8s.node.name": "loggencluster-worker2"
    "k8s.pod.name": "loggen-7cc748d75-xh8lq"
    "k8s.pod.uid": "123456789"
    "k8s.replicaset.name": "loggen-7cc748d75"
    "service.name": "loggen"
    "src_type": "K8s"
  }
  "timestamp": 1733369799254
}

Statement

delete_key(resource, "service.name")

Output

{
  "_type": "log"
  "body": "..."
  "resource": {
    "container.id": "123456789"
    "container.image.name": "docker.io/edgedelta/loggen:latest"
    "ed.conf.id": "123456789"
    "ed.domain": "pipeline"
    "ed.filepath": "/var/log/pods/loggenlogs_loggen-123456789/loggen/0.log"
    "ed.org.id": "987654321"
    "ed.source.name": "Kubernetes Source"
    "ed.source.type": "kubernetes_input"
    "ed.tag": "loggen"
    "host.ip": "172.18.0.5"
    "host.name": "loggencluster-worker2"
    "k8s.container.name": "loggen"
    "k8s.deployment.name": "loggen"
    "k8s.namespace.name": "loggenlogs"
    "k8s.node.name": "loggencluster-worker2"
    "k8s.pod.name": "loggen-7cc748d75-xh8lq"
    "k8s.pod.uid": "123456789"
    "k8s.replicaset.name": "loggen-7cc748d75"
    "src_type": "K8s"
  }
  "timestamp": 1733369799254
}

The log entry is modified to exclude the service.name field from resource, leaving the remaining entries in the resource object.