# Handling missing fields in output filters

**URL:** <https://discuss.elastic.co/t/handling-missing-fields-in-output-filters/45004>\
**Category:** Logstash\
**Created:** [March 21, 2016, 2:38pm UTC](https://discuss.elastic.co/t/handling-missing-fields-in-output-filters/45004 "2016-03-21T14:38:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![eroussel](https://avatars.discourse-cdn.com/v4/letter/e/e47774/32.png) [@eroussel](https://discuss.elastic.co/u/eroussel)\
**Post date:** [March 21, 2016, 2:38pm UTC](https://discuss.elastic.co/t/handling-missing-fields-in-output-filters/45004/1 "2016-03-21T14:38:36Z")

</div>

Hello,

What are my options to handle missing fields in output filters?

Specifically, if in my log message I have a bunch of fields that may or may not exist depending on the case, do I have to do something like:

```
if [main][subsection] {
     ...
     format => "<snip>|%{[main][subsection]}|<snip>"
     ...
}

```

Or is there a way to format the `%{[main][subsection]}` to specify a default value if the field doesn't exists?

Currently if the field doesn't exists, then `%{[main][subsection]}` will show in the string that's output which is a problem.

It would be preferable to output nothing or a specified default value.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/handling-missing-fields-in-output-filters/45004/2 "2017-07-06T05:06:05Z")

</div>