Filebeat Script Processor Event.Get All Fields In Log

Question

I am looking to get all of the fields in a record in filebeat using the Script processor and perform an action on them. Using the event.Get() from the script processor, it says, "Get a value from the event (either a scalar or an object). If the key does not exist null is returned. If no key is provided then an object containing all fields is returned."

https://www.elastic.co/guide/en/beats/filebeat/current/processor-script.html

Therefore, my question is, what would I do to ensure that no key is provided to get an object that contains all of the fields are returned?

Answer 1

The event.Get() field will provide the top level fields. To look through these top level fields, use a for loop like:

  - script:
      lang: javascript
      id: get_fields
      source: >
        function process(event) {
            var a = event.Get();
            for (var key in a) {
              if(event.Get(key) == ""){
                   event.Delete(key);
              }
            }
         }

I am unsure how to do this for nested fields in this way nor have I tried to extend it to nested fields, but this is how it works for now.