What?

As a user I would like to be able to easily drop all fields in a message that are either empty or otherwise not useful in order to reduce storage of unused fields. A common use case is an empty field being denoted by a - value. Ideally, a single rule could be used to drop any fields in a message with this value. For example:

rule "drop fields with - as content"
when
 true
then
 remove_fields_by_content("-");
end

Why?

Currently, this can be accomplished on a field by field basis with many rules that looks like this:

rule "drop field my_field if empty"
when
 to_string($message.my_field) == "-"
then
 remove_single_field("my_field");
end

Supporting this in a single pipeline rule would make this cleanup much more efficient.

See https://github.com/Graylog2/support/issues/202 for more context.