Csv filter : how to deal with missing field?

Elastic Stack Logstash
3

Thank you @Badger . I'm going to test this.

As a temporary workaround, I found this :

filter
{

grok {
  match => { "message" => "<%{POSINT:syslog_pri}>(%{SYSLOGTIMESTAMP:syslog_timestamp}) %{IP:syslog_host_ip} %{HOSTNAME:syslog_host} %{SYSLOGPROG:syslog_prog}: %{YEAR}/%{MONTHNUM}/%{MONTHDAY}-%{HOUR}:%{MINUTE}:%{SECOND}, (\[%{DATA:maps}\])?, %{INT:to_define}, %{DATA:wwn}, %{WORD:severity}, %{HOSTNAME:device_name}, %{DATA:port_name}, F-Port %{INT:port_number}, Condition=%{DATA:condition}, Current Value:\[(%{DATA:current_value_1})?, (%{DATA:current_value_2}])?, RuleName=%{DATA:rule_name}, Dashboard Category=%{DATA:dashboard_category}\." }
}

if [current_value_2] =~ ".*Delay.*" {
        grok {
                match => { "current_value_2" => "%{INT:frame_delay}"}
        }
}
}