Change null value from database for one field using logstash and insert into Elasticsearch

Elastic Stack Logstash
1

I would like to replace the value of field with NULL to some other
value. This field is obtained by using Logstash JDBC plugin from
database. Here is my config file.

input {
jdbc {
jdbc_connection_string => "url"
jdbc_user => "user"
jdbc_password => "pswd"
jdbc_driver_library => "./ifxjdbc-3-50-JC7.jar"
jdbc_driver_class => "com.informix.jdbc.IfxDriver"
statement =>  ["SELECT st1.name as s_name, st1.typ, st2.name as comp_name, zen.s_id, zen.comp_id,    zen.conc_1, zen.conc_2 FROM sub_zen zen join sub st1 on st1.id = zen.s_id join sub st2 on st2.id = zen.comp_id"]}}

What I would like to do here is replace the nil value (by default typ is always nil) to P. I tried this so far.

filter{
mutate {

gsub => [

  "typ", "nil", "P"

]

}
}

Does not work.

I tried this also but it throws error

filter{
 ruby {

 code => "

 if event.get('typ') == nil

 event.set('typ') == P

end
"

}
}

Can someone help here. How I can fix this.

2

@fbaligand here you go opened a new issue

3

You can try this code in ruby filter :

event.set('typ', 'P') if event.get('typ').nil?

4

Thanks! But there is small correction here. Instead of single quote (') one has to use double quotes ("). Rest works great! U r great!

5

Very strange...

I mean :
If you use double quotes for code option (code => " ... "), you must use simple quotes in your code inside.
And on the contrary, if you use simple quotes for code option, you must use double quotes in your code inside.

6

By the way, here's a more generic way to do that :

ruby {
  code => "
      event.to_hash.each do |key,value|
          event.set(key, 'P') if value.nil?
      end
  "
}
7

yes, you are right. This is how it is working at the moment. Ok, another question and probably you would ask me to open a new issue.

8

Here is the link to my other question:

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.