Check if sub-field exists

Elastic Stack Logstash
1

I need an if else statement to check if a sub field exists. I want ed to know if a sub-field "city_name" exists in main field dst_geoip. Below is what I'm trying to do

if ![dst_geoip][city_name] {mutate{add_field => { "[dst_geoip][city_name]" => "nil" }}}

Anyone knows the right way to write the if else statement

2

What you've written should work. What happens? And are you sure you want to set the field to a literal "nil"?

3

I intend to send these into another application when require all fields to be present despite certain fields are non-existence in current set of logs.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.