Check if event field does not exist when 'nil' should be considered as "exists"

[e.sharshenaliev (Edil)]

We are indexing metrics that arrive to logstash in json format
There is a value "MeasurementDate" that can either:

1. be missing
2. has null value
3. has date value (iso8601)

When field has valid value or is missing - we need to index this event
When field has value of null - we need to drop this event

Is there any way to differentiate between missing field and field with a value of null/nil?

[Badger]

@e.sharshenaliev

Is there any way to differentiate between missing field and field with a value of null/nil?

You cannot do it using a conditional, but you can do it in ruby

    ruby {
        code => '
            if event.to_hash.include?("foo") and ! event.get("foo")
                event.cancel
            end
        '
    }