The exception.stacktrace field is set in a grok match above.
Using the same message, if I remove the conditional, then the gsub is applied as expected, thus the conditional is not working!
I need to use the conditional because my grok matcher has two patterns, one with stacktrace other without it.
Is this a bug, or it's not the correct way to check a nested field existance?
If that is a nested field then you have to refer to it as "[exception][stacktrace]" in the gsub. If it has a period in its name then you need to refer to it as [exception.stacktrace] in the conditional.
Removing only the conditional, and keeping the field name "exception.stacktrace" in gsub works, and my stacktrace is correctly processed, so the issue is not gsub field name:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.