How to remove underscores in field names with logs

Question

I'm thinking about using the mutate filter and the rename option, but I don't know about the corresponding regex to achieve that:

filter {
  mutate {
    rename => {
      "any_field_with_underscore" => "anyfieldwithunderscore" # i don't know how to write regex for this ...
    }
  }
}

Can anyone help?

Answer 1

To build on Alain's answer,

In Logstash >= 5.x, an event object accessor is enforced:

 ruby {

  code => "
        begin
            keys = event.to_hash.keys
            keys.each{|key|
                if ( key =~ /http_/ )

                    newkey = key.gsub(/http_/, '')
                    event.set(newkey, event.remove(key))

                end
            }

        rescue Exception => e
            event.set('logstash_ruby_exception', 'underscores: ' + e.message)
        end
        "
 }

}

Also see this feature request that would do the same

Answer 2

There no indication in the doc that rename{} takes a regexp.

I've seen this done with a ruby{} filter.

As requested, here's some untested Ruby:

begin
    keys = event.to_hash.keys
    keys.each{|key|
        if ( key =~ /_/ )

            newkey = key.gsub(/_/, '')
            event[newkey] = event.remove(key)

        end
    }

rescue Exception => e
    event['logstash_ruby_exception'] = 'underscores: ' + e.message
end