# De\_dot adding fields

**URL:** <https://discuss.elastic.co/t/de-dot-adding-fields/34425>\
**Category:** Logstash\
**Created:** [November 12, 2015, 2:53pm UTC](https://discuss.elastic.co/t/de-dot-adding-fields/34425 "2015-11-12T14:53:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tgdesrochers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tgdesrochers/32/51322_2.png) [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\
**Post date:** [November 12, 2015, 2:53pm UTC](https://discuss.elastic.co/t/de-dot-adding-fields/34425/1 "2015-11-12T14:53:57Z")

</div>

When I use the de\_dot filter I am using a conditional statement that states:

```
filter {
  if [type] == "BRO" {
    if [log_path] == "software" {
      de_dot {
        fields => [
          "version.major",
          "version.minor",
          "version.minor2",
          "version.minor3",
          "version.addl"
        ]
      }
    }
    if [log_path] == "x509" {
      de_dot {
        fields => [
          "certificate.version",
          "certificate.serial",
          "certificate.subject",
          "certificate.issuer",
          "certificate.exponent",
          "certificate.curve",
          "sans.dns",
          "basic_constraints.ca"
        ]
      }
    }
    if [log_path] == "intel" {
      de_dot {
        fields => [
          "seen.indicator",
          "seen.where",
          "seen.node"
        ]
      }
    }
[rest of filters]
}
```

but this has the unintended consequence of adding the de\_dot'd field to the record even if it doesn't have that field. My issue is that sometimes these logs contain the fields and sometimes they don't. But the de\_dot filter is adding the field (without the dots) to every record creating nil fields, see below:

```
"version_minor2" => nil,
      "version_minor3" => nil,
        "version_addl" => nil
```

Is there a way to tell the filter not to add the field. I stumbled upon this issue because I initially tried to use the syntax:

```
if [log_path] in ["software","intel","x509"] {
      de_dot {
        fields => [
         .......
```

But what this did is append all records in the above ref'd logs with all de\_dot'd fields creating a very large amount of nil fields.

So back to the question.....Is there a way to have de\_dot look for the field specified and only de\_dot it if it exists, or should I do some @metadata tagging to say if that field exists tag with a new metadata field then apply de\_dot if that condition is met?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [November 12, 2015, 3:51pm UTC](https://discuss.elastic.co/t/de-dot-adding-fields/34425/2 "2015-11-12T15:51:01Z")

</div>

Please raise this as an issue at [https://github.com/logstash-plugins/logstash-filter-de\_dot](https://github.com/logstash-plugins/logstash-filter-de_dot)

We can add functionality to check if the field exists before acting. Until we do, your remedy is to use conditionals and tag, or to let it look at all fields (or use a combination to only look at events which _may_ have dotted fields).

---

<div class="post-metadata">

**Author:** ![tgdesrochers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tgdesrochers/32/51322_2.png) [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\
**Post date:** [November 12, 2015, 4:09pm UTC](https://discuss.elastic.co/t/de-dot-adding-fields/34425/3 "2015-11-12T16:09:50Z")

</div>

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/de-dot-adding-fields/34425/4 "2017-07-06T05:23:01Z")

</div>

Closed on July 6, 2017, 5:23am UTC