# Assign a value if field has no value present

**URL:** <https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578>\
**Category:** Logstash\
**Created:** [August 2, 2019, 3:16pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578 "2019-08-02T15:16:00Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 2, 2019, 3:16pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/1 "2019-08-02T15:16:00Z")

</div>

I am gone a read a csv formated file which has more then 50 field,  
by default I want to assign a value "UNKNOWN" to any blank field. how do I easily do it ?

on smaller files I have done  
if ![var1] { mutate {update......

but for this long if there is a way to do it for all.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2019, 4:04pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/2 "2019-08-02T16:04:22Z")

</div>

You could try

```
    ruby {
        init => '
            Columns = ["C1", "C2"]
        '
        code => '
            Columns.each { |k|
                unless event.get(k)
                    event.set(k, "UNKNOWN")
                end
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 2, 2019, 5:01pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/3 "2019-08-02T17:01:08Z")

</div>

Badger,  
can you explain what is columns = ["c1" , "c2"] is doing?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 2, 2019, 5:29pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/4 "2019-08-02T17:29:42Z")

</div>

Those would be the names of the columns in the CSV file, that is, the set of fields that you want to set to unknown if they are not present in the CSV. I should have mentioned that you will want to set [skip\_empty\_columns](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html#plugins-filters-csv-skip_empty_columns) on the csv filter so that the fields do not get created if they are empty.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 2, 2019, 5:33pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/5 "2019-08-02T17:33:41Z")

</div>

perefect I will give this a try next week.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 2, 2019, 8:53pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/6 "2019-08-02T20:53:10Z")

</div>

Worked. just had to put longgg columns list, alll empty field has value now.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 26, 2019, 9:04pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/7 "2019-08-26T21:04:35Z")

</div>

Hi quick question this thread again.  
Can I do this without explicitly to all the columns. i.e columns = ['\*]

I try Star with quote,doublequote, singlequote etc.. none of them worked.

```
ruby {
    init => '
        Columns = ["C1", "C2"]
    '
    code => '
        Columns.each { |k|
            unless event.get(k)
                event.set(k, "UNKNOWN")
            end
        }
    '
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 26, 2019, 10:46pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/8 "2019-08-26T22:46:00Z")

</div>

The following might work

```
    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v == nil
                    event.set(k, "UNKNOWN")
                end
            }
        '
    }

```

I cannot remember why I did not suggest this earlier, but there may have been a reason.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [August 27, 2019, 3:47pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/9 "2019-08-27T15:47:17Z")

</div>

@Badger

this one did work Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2019, 3:47pm UTC](https://discuss.elastic.co/t/assign-a-value-if-field-has-no-value-present/193578/10 "2019-09-24T15:47:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.