Hi, I have a log that has a json field inside that can have empty fields, specifically I have a date field, the log can be like this "2022-11-28 09:24:46:705"|"+0100"|"transId: xxxxxx"|"resId: xxxxxx"|"1.1.1.1"|" https://example.com/xxxxxx"|"HTTP/1.1"|"EXE"|"GET"|"404"|" {"codCpi":"","codFis": "","c…

You can remove the field if it is empty. if [dateBirth] == "" { mutate { remove_field => ["dateBirth"] } }

Cannot parse empty date

carly.richmond (Carly Richmond) December 6, 2022, 12:45pm 2

To confirm, are you only receiving this error for events where datBirth is empty, and parsing is successful when it's populated?

If so you could try specifying zero or one occurrences using the ? operator, as per the below:

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.