Event is not created for null value records

Elastic Stack Logstash
1

Hi All

I have a json file, which is in this below format, for all the records date2 is always null.
But in future this date2 can have the value.

Since currently date2 is having null value, because of this date2 event itself is not created.

Although i can see events with name,date1 and status but not with date2

How can i make sure date2 event is created with null values?

"testing" : {
						"name" : "Formal Test",
						"date1" : "05/22/2017 00:00:00 PDT",
						"date2" : null,
						"status" : "active"
					},
2

Does anyone face this problem?

Is this not supported, the documentation is not clear

See, section : When null Means null

When choosing a suitable null_value, ensure the following:

It matches the field’s type. You can’t use a string null_value in a field of type date.
It is different from the normal values that the field may contain, to avoid confusing real values with null values.

Eventhough i am trying to convert the null string to "", it is not working, since event itself is not getting created so there is no use of applying filter

3

Hi All

Anyone have idea on this subject?

4

I could be wrong but I think from my own testing I've found that if a field that is either an object or a date then it can't be null or empty. My workaround is to check if ![field] and then remove it or set some non-null value.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.