Does Logstash support wilcards for multiple empty fields

Elastic Stack Logstash
1

Hello,

I know that in Logstash I can check if a field is empty with the following
if ![myfield] { do something }

Having said that I though that wildcards will match all fields that are empty but that was not the case.
Does somebody know how to match any field that is empty and not just a single one?
For instance i don't know which fields will be empty and I try to fill them all with a dummy value

Thank you in advance.

2

Also say I don't want to chase after empty fields but ones that contains a pipe (|)?

I read on the internet that ruby code is my answer but I don't do Ruby :slight_smile: Could you please paste some code that will help to do what I want?

3

Found it using ruby :slight_smile:
If you're field is null substitute "|" with nil, or if your field is not empty but blank then substitute "|" with empty string ""

ruby {
        code => '
            event.to_hash.each { |k, v|
                if v == "|"
                    event.set(k, "N/A")
                end
            }
        '
    }