Assign default value to a field if no value is present

Hi,
I am reading a log message with KV pairs in logstash and sending them over to Elastic Search. If some of the fields dont have value, i want to assing a default value like "N/A" instead of sending them as "%FIELD_NAME".

For eg., I am constructing a JSON in logstash like below. if "environment" is not present in the input message, i need to assign default value

"[application][environment]" => "%{environment}"

Thanks for your help!!

if [environment] {
    mutate { add_field => { "[application][environment]" => "%{environment}" } }
} else {
    mutate { add_field => { "[application][environment]" => "N/A" } }
}

Thanks, that worked !!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.