Conditional access for nested fields


my logstash config won't perform as i think it should and I'm not sure why.

I'd like to check if the field url.scheme does not exist and if the condition is true, I'd like to perform some actions. But I'm failing at the condition.

Logstash: 7.5.0

if ![url][scheme] {
  mutate {
    add_tag => [ "foo" ]


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.