# Check existence of a field and checking null value in field

**URL:** https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968
**Category:** Logstash
**Created:** [July 6, 2015, 5:24pm UTC](https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968 "2015-07-06T17:24:56Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![DavidL](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@DavidL](https://discuss.elastic.co/u/DavidL)
#### Post date: [July 6, 2015, 5:24pm UTC](https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968/1 "2015-07-06T17:24:56Z")

</div>

I have different types of logs generated by the software we user in one big file. I am trying to assign "log\_type" to different types of logs in my file. Since they have different number of columns(I used csv plugin to parse them), I tried to differentiate them by checking the existence of unique field. In the below example, the top event doesn't have column 16, but the bottom one does.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/6/6359f9d41237af709e4f94cad844ed109d9f481b.png)

So my config looked like this:

if [column16] {  
... "type1"  
}else {  
... "type2"  
}

but as it shows in the picture, they got assigned the same type number, I think the above if statement doesn't work, it can't tell the difference between a null value in the field and the field doesn't exist.

any suggestions?

---

<div class="post-metadata">

### Author: ![talevy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talevy/32/44896_2.png) [@talevy](https://discuss.elastic.co/u/talevy)
#### Post date: [July 7, 2015, 6:15am UTC](https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968/2 "2015-07-07T06:15:01Z")

</div>

There does not seem to be a straightforward way to accomplish this.

I suggest using the ruby filter for now to call `event.include?("[column16]")` and add a tag based on that or something so that you can continue with your normal branch conditionals.

---

<div class="post-metadata">

### Author: ![talevy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talevy/32/44896_2.png) [@talevy](https://discuss.elastic.co/u/talevy)
#### Post date: [July 7, 2015, 8:53pm UTC](https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968/3 "2015-07-07T20:53:51Z")

</div>

filed an issue for this here: [https://github.com/elastic/logstash/issues/3568](https://github.com/elastic/logstash/issues/3568)

---

<div class="post-metadata">

### Author: ![mbertani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mbertani/32/11398_2.png) [@mbertani](https://discuss.elastic.co/u/mbertani)
#### Post date: [April 5, 2016, 8:28pm UTC](https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968/4 "2016-04-05T20:28:18Z")

</div>

Developing further the idea of using the ruby filter, can you try something like this?

````ruby
                    code => "
					if event['column16'] == nil
						event['log_type'] = 'type2'
					else
						event['log_type'] = 'type1'
					end					
			"
	}```
````

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/check-existence-of-a-field-and-checking-null-value-in-field/24968/5 "2017-07-06T05:03:42Z")

</div>