How to check length of an array field in logstash

Elastic Stack Logstash
1

Hey everyone, can you give me some example about pipeline config to check if an array field is not null? and how i combine it with if else?

i already made config like this
image

and i want to create some if statement under if [tries] to check the length of the tries field. so if tries field like this "tries" : [] it will bypass those actions. Thanks

fyi, i use v7.17.0

2

If you want to check whether an array is empty you can use

if [tries] and [tries][0] { ... it is not empty
3

it is equal to == 0 condition right? if i want to create the reverse like != 0 how i made it? will it be like this?

if [tries] and [tries]![0]
or
if [tries] and !([tries][0])

4

I showed you how to check if [tries] is a non-empty array. What do you want to check now? That it is an empty array?

5

Yes, there is an empty array on logs. So i want to make a condition to check if the array field is not empty. I already made like this
IMG-20230315-WA0001

6

I showed you how to do that in my first answer.

7

Can you explain the logic? Because when i see it at the first time, i think its equal to == 0 Because there is 0 on condition and there is no ! or something like that to make it reverse. Thanks

8

if [tries] tests whether the [tries] field exists. If it does not this short-circuits (prevents) the execution of the and [tries][0] which would get an exception if the field does not exist. and [tries][0] tests if the first entry in the [tries] array exists.

9

I just remember that array started at 0 right? Now everything makes sense. Thanks

Pada tanggal Kam, 16 Mar 2023 07.32, Badger via Discuss the Elastic Stack <notifications@elastic.discoursemail.com> menulis:

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.