How to check length of an array field in logstash

Hey everyone, can you give me some example about pipeline config to check if an array field is not null? and how i combine it with if else?

i already made config like this

and i want to create some if statement under if [tries] to check the length of the tries field. so if tries field like this "tries" : [] it will bypass those actions. Thanks

fyi, i use v7.17.0

If you want to check whether an array is empty you can use

if [tries] and [tries][0] { ... it is not empty

it is equal to == 0 condition right? if i want to create the reverse like != 0 how i made it? will it be like this?

if [tries] and [tries]![0]
if [tries] and !([tries][0])

I showed you how to check if [tries] is a non-empty array. What do you want to check now? That it is an empty array?

Yes, there is an empty array on logs. So i want to make a condition to check if the array field is not empty. I already made like this

I showed you how to do that in my first answer.

Can you explain the logic? Because when i see it at the first time, i think its equal to == 0 Because there is 0 on condition and there is no ! or something like that to make it reverse. Thanks

if [tries] tests whether the [tries] field exists. If it does not this short-circuits (prevents) the execution of the and [tries][0] which would get an exception if the field does not exist. and [tries][0] tests if the first entry in the [tries] array exists.

I just remember that array started at 0 right? Now everything makes sense. Thanks

Pada tanggal Kam, 16 Mar 2023 07.32, Badger via Discuss the Elastic Stack <> menulis:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.