Hi,
I am trying to find how to check if a field exist in the ruby filter.
To check the existence of a field in Ruby, I tried the following three, seems that none of them work
if event['duration']['time'] =~ /.+/
if event['duration']['time'] != nil
if(event['duration']['time'])
Any suggestions?
My code is like:
filter {
json {
source => "message"
}
if [profiling][method] =~ /.+/ {
ruby {
code => "
if(event['duration']['time'])
event['timeStart'] = event['timeEnd'] - event['duration']['time']
end"
}
}
}