This is seeming to drop everything. Even if there is content in foo. Some logs come with foo="" and some come with foo="bar". When I put this conditional in the config, I don't receive any logs.
With "foo" => "\"\"" the string isn't empty; it contains two double quotes. Perhaps you should use the mutate filter's gsub option to remove leading and trailing double quotes before your conditional?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.