Add field only if its does not exists?

Elastic Stack Logstash
1

I expect this is common, but I can't seem to find any info on how to set a field /only/ if it does not already exist.

I have tried translate:

translate {
  field => "level"
  dictionary => [
    "DEBUG", "DEBUG",
    "INFO",  "INFO",
    "WARN",  "WARN",
    "ERR",   "ERROR"
  ]
  fallback => "INFO"
  exact => true
}

But when 'level' does not exist the fallback does not trigger.

I've also tried:

  if "" in [level] {
    mutate { add_field => { "level" => "INFO" } }
  }

And

  if [level] == "" {
    mutate { add_field => { "level" => "INFO" } }
  }

Oh, and I also tried

translate {
  field => "level"
  dictionary => [
    "DEBUG", "DEBUG",
    "INFO",  "INFO",
    "WARN",  "WARN",
    "ERR",   "ERROR",
    "", "INFO"
  ]
  exact => true
}
1 Like
2

Ok, I found it

  if ![level] {
    mutate { add_field => { "level" => "INFO" } }
  }
4 Likes
3

Is all you should need for the comparison.