# Empty variable vs. non-existent one

**URL:** <https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095>\
**Category:** Logstash\
**Created:** [October 10, 2019, 6:32pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095 "2019-10-10T18:32:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pgf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgf/32/47996_2.png) [@pgf](https://discuss.elastic.co/u/pgf)\
**Post date:** [October 10, 2019, 6:32pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095/1 "2019-10-10T18:32:00Z")

</div>

Is there any way to tell the difference between an empty variable and a non-existent one? The code  
if [v1] == "" {  
do something  
}  
acts exactly the same whether the variable exists and is empty or does not exist at all. The trouble is that the following code has two different results depending on whether the variable exists or not:  
if [v1] == "" {  
mutate { add\_field =\> { "[v2]" =\> "value2" } }  
}

If [v1] does not exist then [v2] contains "value2". If [v1] exists and is empty then [v2] is an array ["", "value2"]. If I change the add\_field to update then in the first case [v2] does not get created (cannot update a non-existent variable) and [v2] is a scalar "value2".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 7:13pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095/2 "2019-10-10T19:13:24Z")

</div>

The usual way to test for existence is

```
if [v1] { [...]

```

I know of no way to distinguish between a nil value and non-existence.

---

<div class="post-metadata">

**Author:** ![pgf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgf/32/47996_2.png) [@pgf](https://discuss.elastic.co/u/pgf)\
**Post date:** [October 11, 2019, 12:07pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095/3 "2019-10-11T12:07:17Z")

</div>

Very irritating. This makes it virtually impossible to ensure in Logstash that key fields will always be present. Seems like a very big deficiency.

Thanks for the answer @Badger.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 11, 2019, 3:38pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095/4 "2019-10-11T15:38:13Z")

</div>

Does [mutate+coerce](https://github.com/logstash-plugins/logstash-filter-mutate/blob/93a8b59205919229341c9db9c25140fba7a6734d/lib/logstash/filters/mutate.rb#L277) help? And note that using event.include? in a ruby filter does allow one to distinguish between a nil value and non-existence. That's one more thing I learned today 🙂

---

<div class="post-metadata">

**Author:** ![pgf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pgf/32/47996_2.png) [@pgf](https://discuss.elastic.co/u/pgf)\
**Post date:** [October 11, 2019, 6:18pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095/5 "2019-10-11T18:18:02Z")

</div>

@Badger I played with coerce a bit but it seems to have absolutely no effect. I need to try it in more controlled circumstances. I have thought about the ruby filter but I am worried about performance. Good suggestions though. I have also tried variations on update and replace which sound almost exactly the same in the doc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2019, 6:18pm UTC](https://discuss.elastic.co/t/empty-variable-vs-non-existent-one/203095/6 "2019-11-08T18:18:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.