How to drop a nested field that has an empty value?

Elastic Stack Logstash
1

it's possible to drop a nested field in case the value is empty?
example:
"log":{"business_information":""}

background:
this is a workaround to avoid mapping issues, as other application logs are creating fields like:
log.business_information.id
log.business_information.trace

log.business_information is mapped as an object. In case an event with empty value will appear, this event is lost due mapping conflict:
object mapping for [log.business_information] tried to parse field [business_information] as object, but found a concrete value"

2

I have not tested it but I would expect

if [log][business_information] == "" { drop {} }

to work.

3

Thanks for the hint.
We ended up with this configuration:

if [log][business_information] =~ /.*/ {
mutate {
rename => ["[log][business_information]", "[log][business_information_text]"]
}

and in second step the new field is deleted, in case it's empty.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.