Condition to check if two or three fields exist

Elastic Stack Logstash
1

Hello,
I have the following condition in the logstash filter section:

if [MD5] {
mutate { add_field => { "md5_field" => "MD5 Hash is: %{MD5}" for %{url} and %{location}}}
}

It is not solid enough, because if url or location json field does not exist it will print into the field %{url} or %{location}.
Is there a way to check for the existence of those three fields in one if condition?

For example:

if [MD5] and [url] and [location] {
mutate { add_field => { "md5_field" => "MD5 Hash is: %{MD5}" for %{url} and %{location}}}
}

Thanks.

2

the workaround I found is:

if [MD5]{
if [url]{
your_action
}
}

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.