Create field if it's not equal "Undefined"


(Sergey) #1

Hi!
I have logs:
days_in_game: 198; pvp_rating: 63; provider: Undefined;
And i want to crete field "provider" in documents when it's not equal "Undefined".
Can you write me filter config for this?
THX!


(Magnus B├Ąck) #2

Use a csv filter to parse the message into (in your example) three fields, then use a conditional to selectively include a mutate filter that drops the provider field if it's "Undefined".


(system) #3