Can I use conditionals inside json {} filter?

[mfloris (MF)]

My input does not always contain some fields and I want to parse it accordingly, like this:

filter {
  json {
    source => "message"
    if "thisField" in [message] {
      add_field => { "MyField" => "%{[message][thisField]}" }
    } else {
      add_field => { "MyField" => "empty" }
    }
  }
}

I'm getting syntax errors and I can't find examples of what I'm doing online, therefore I suspect it's not allowed. Is it? If not, what other path could I follow?

[Badger]

You cannot use conditionals inside a plugin configuration. You can do

json { source => "message" }
if "thisField" in [message] {
    mutate { add_field => { "MyField" => "%{[message][thisField]}" } }
} else {
    mutate { add_field => { "MyField" => "empty" } }
}

Although I suspect the %{[message][thisField]} reference is wrong.