mutate { strip => } adds fields instead of removing one

Description

I've got a simple config to filter unwanted fields due to bad logfile design.

input { file { path => "my_test.log" } }
filter {
kv {}
mutate { strip => "^(\"|-\w|[|)|(|]|\/|{|}|!|\'|+|?|https?:\/\/|org.logger.customLogger)" }
}
output { stdout { codec => rubydebug }}

The input is (sadly) some kind of unstructured log. My filter should remove fields from the document that have certain error conditions like starting with special characters like "(){}[]--. Partly my documents seem to contain json objects.

The result is something like this:
{
"message" => "..",
"@version" => "1",
"@timestamp" => "2014-05-02T09:46:46.968Z",
"host" => "marcus.local",
"path" => "/Users/marcus/logstash-1.4.0/inputs.log",
"\"/p/2-in-1-url-sessionID/#variationId" => [
[0] "389907604\",",
[1] "389907610\",",
[2] "389907581\",",
[3] "389907607\","
],
"n-1-url-sessionID/#variationId" => "389908639\",",
"^(\\\"|-
w|
" => {
"|\\)|\\(|
" => {}
}
}

Without my regex I just have the /p/2-in-1 and the n-1- fields, but with the mutate.strip config, I get the additional two lines at the end of the document.

Activity

Show:
Marcus Franke
May 2, 2014, 10:32 AM

If I replace mutate.strip with grep.remove_field, I get the same additional fields.

Suyog Rao
February 7, 2015, 12:50 AM

Assignee

Logstash Developers

Reporter

Marcus Franke

Labels

Affects versions

Configure