Use parser extension to remove field mapping

[lukas-lr]

Hi everyone,

Is there a way to delete a field value by using a parser extension? I want to "move" a value from one UDM field to the other, leaving the UDM field used by the default parser empty. However, I could not find an explicit way to set it to null or empty, such that the value set by the default parser is removed from the UDM event.

[deeshu]

You can use mutate to store the values in different udm field. What's your use case for keeping the UDM empty? AFAIK blank UDM field will not be visible in UDM Events.

[lukas-lr]

In some events, the default parser writes data fields containing two different hosts in fields of the principal noun. I want to separate that, so there is no confusion for example which host a process id belongs to. But since there is no process id in the raw log for the host which I want to have in the principal, I have to remove it from there. Just setting it blank is ignored by the logic which merges the original event which the one from the extension.

[cmmartin_google · Accepted solution]

You can't remove a mapping from the default parser is my understanding of using Parser Extensions.

You can write a GROK extension to take the original value from the raw log into a new UDM field, but if you add a value as empty then the original UDM value will be used.

I think this would be a FR for Parser Extensions to support this, or else an update to the default parser via support.