regex - How to remove underscores in field names with logstash?

Question

I'm thinking about using the mutate filter and the rename option, but I don't know about the corresponding regex to achieve that:

filter {
  mutate {
    rename => {
      "any_field_with_underscore" => "anyfieldwithunderscore" # i don't know how to write regex for this ...
    }
  }
}

Can anyone help?

Answer 1

There no indication in the doc that rename{} takes a regexp.

I've seen this done with a ruby{} filter.

As requested, here's some untested Ruby:

begin
    keys = event.to_hash.keys
    keys.each{|key|
        if ( key =~ /_/ )

            newkey = key.gsub(/_/, '')
            event[newkey] = event.remove(key)

        end
    }

rescue Exception => e
    event['logstash_ruby_exception'] = 'underscores: ' + e.message
end