Handling missing fields in output filters

Elastic Stack Logstash
1

Hello,

What are my options to handle missing fields in output filters?

Specifically, if in my log message I have a bunch of fields that may or may not exist depending on the case, do I have to do something like:

if [main][subsection] {
     ...
     format => "<snip>|%{[main][subsection]}|<snip>"
     ...
}

Or is there a way to format the %{[main][subsection]} to specify a default value if the field doesn't exists?

Currently if the field doesn't exists, then %{[main][subsection]} will show in the string that's output which is a problem.

It would be preferable to output nothing or a specified default value.

1 Like