So I have some values being fed from logstash, and they are failing input into Elastic because I have a template being used, and the values sometimes don't adhere to the tablet.
Notably, I get the values "-" and "(empty)", which don't work well in a field designated as an integer or double...
What I would like to do is designate these values as nulls within logstash, because that's how they should be treated (that's what they really are). An Elastic field designated as "integer" doesn't puke if it's given just a null value.
What is the best way to do this? Do I need to use a ruby filter, and iterate through all values, checking them against my unwanted values, and changing them on the fly (and if so, what would this look like. I can't find much about how to handle the ruby 'event' field)? Is there another plugin that easily handles this?
I can do the same things with sub, but you have to list out every field that would need to be changed. If I have 25 different feeds, then that becomes a cumbersome list to maintain.