# How to check, if a hash is empty (no keys)

**URL:** <https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227>\
**Category:** Logstash\
**Created:** [July 14, 2017, 5:56pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227 "2017-07-14T17:56:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![UnitedMarsupials](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/unitedmarsupials/32/19429_2.png) [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\
**Post date:** [July 14, 2017, 5:56pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227/1 "2017-07-14T17:56:48Z")

</div>

I tried to use the same [method as for arrays](https://discuss.elastic.co/t/how-can-i-check-if-the-tags-array-is-empty/27856) for a hash, that in our case could some times be empty:

```
if [geoip] == [] {
        mutate {
                remove_field => ["geoip"]
        }
}

```

Unfortunately, the check is not working and the empty geoip-hashes slip into the outputs. I then tried to compare `[geoip]` with `{}` and got a syntax error. I then tried `"{}"` (quoted), which had no effect -- the empties still made it. Is it possible to detect an empty hash -- and remove it? Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2017, 7:37pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227/2 "2017-07-14T19:37:57Z")

</div>

I don't think the Logstash configuration language really has hash literals in the same way it has array literals in which case this isn't possible except with a ruby filter.

---

<div class="post-metadata">

**Author:** ![Mikhail\_T](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@Mikhail\_T](https://discuss.elastic.co/u/Mikhail_T)\
**Post date:** [July 14, 2017, 8:21pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227/3 "2017-07-14T20:21:06Z")

</div>

Could you show, how to do it with the ruby-filter?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2017, 9:15pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227/4 "2017-07-14T21:15:02Z")

</div>

Untested but probably works:

```
event.remove('name-of-field') if !event.get('name-of-field').nil? && event.get('name-of-field').empty?
```

---

<div class="post-metadata">

**Author:** ![UnitedMarsupials](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/unitedmarsupials/32/19429_2.png) [@UnitedMarsupials](https://discuss.elastic.co/u/UnitedMarsupials)\
**Post date:** [July 17, 2017, 1:55pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227/5 "2017-07-17T13:55:38Z")

</div>

Thanks, Magnus, I'll try it. Meanwhile, generally speaking, should not the removal of the last key-\>value pair from a hash remove the now-empty hash _automatically_?

Ruby does not do it, but Logstash probably can -- and should...

By the way, the `get()` method is not available in Logstash-2.3, which we are currently using. Fortunately, an event's field can still be accessed through the `[]` notation (not documented anywhere I could find). But if the field does not exist, the result will be `nil`, which can not be checked for `empty?`ness, so my filter reads thus:

```
	ruby {
                # Initialize the suspects once:
                init => "SuspectFields = ['geoip', 'cdn']"
		code => "
			SuspectFields.each do |field|
				event.remove(field) if event[field].nil? or event[field].empty?
			end
		"
	}

```

This seems to work. Thanks again for your advice.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2017, 1:55pm UTC](https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227/6 "2017-08-14T13:55:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.