Create field if it's not equal "Undefined"

(Sergey) #1

I have logs:
days_in_game: 198; pvp_rating: 63; provider: Undefined;
And i want to crete field "provider" in documents when it's not equal "Undefined".
Can you write me filter config for this?

(Magnus B├Ąck) #2

Use a csv filter to parse the message into (in your example) three fields, then use a conditional to selectively include a mutate filter that drops the provider field if it's "Undefined".

(system) #3