Thanks Much for the suggestion, I ended up using two pattern and split rather than KV split. like
us="(%{INT:[nginx][access][upstream][status]:int}|-)"
and if grok failure
us="(%{DATA:[nginx][access][upstream][status]}|-)"
Then a split for to separate values
split => [ "[nginx][access][upstream][status]", "," ]
Then a convert to convert it to integer inside the if loop of grok failure.
"[nginx][access][upstream][status]" => "integer"
Now all working fine but could you please modify the ruby code check in all fields and if that any thing matches to hyphen - then remove that field ?