# How to handle default value for logstash pipeline efficiently?

**URL:** <https://discuss.elastic.co/t/how-to-handle-default-value-for-logstash-pipeline-efficiently/330335>\
**Category:** Logstash\
**Created:** [April 19, 2023, 9:14pm UTC](https://discuss.elastic.co/t/how-to-handle-default-value-for-logstash-pipeline-efficiently/330335 "2023-04-19T21:14:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hatef\_Alipour](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hatef_alipour/32/120012_2.png) [@Hatef\_Alipour](https://discuss.elastic.co/u/Hatef_Alipour)\
**Post date:** [April 19, 2023, 9:14pm UTC](https://discuss.elastic.co/t/how-to-handle-default-value-for-logstash-pipeline-efficiently/330335/1 "2023-04-19T21:14:04Z")

</div>

I have a logstash pipeline that its filter part looks like this:

```auto
   filter {
    
        if condition {
            prune {
                blacklist_names => ["^cat[1-8]$","^classifier.version$","^accessory_check$"]
            }
            http {
                url => aURL
                query => {
                    // relevant parts
                }
                verb => GET
                body_format => "json"
                ecs_compatibility => "disabled"
                 add_field => {
                     "cat1" => "%{[body][cat1]}"
                     "cat2" => "%{[body][cat2]}"
                     "cat3" => "%{[body][cat3]}"
                     "cat4" => "%{[body][cat4]}"
                     "cat5" => "%{[body][cat5]}"
                     "cat6" => "%{[body][cat6]}"
                     "cat7" => "%{[body][cat7]}"
                     "cat8" => "%{[body][cat8]}"
                     "accessory_check" => "%{[body][accessory_check]}"
                     "classifier.version" => "${CLASSIFIER_LATEST_VERSION}"
                 }
                remove_field => ["body","headers","@timestamp","@version"]
            }
        }
    }

```

As you know if for example "%{[body][cat1]}" be null then the value of cat1 would be string "%{[body][cat1]}" . but I want the value of cat1 be "" instead of "%{[body][cat1]}".

I could solve the problem by changing the pipeline like this:

```auto
          filter {
            if condition {
                prune {
                    blacklist_names => ["^cat[1-8]$","^classifier.version$","^accessory_check$"]
                }
                http {
                    url => aURL
                    query => {
                      // relevant parts
                    }
                    verb => GET
                    body_format => "json"
                    ecs_compatibility => "disabled"
        # add_field => {
        # "cat1" => "%{[body][cat1]}"
        # "cat2" => "%{[body][cat2]}"
        # "cat3" => "%{[body][cat3]}"
        # "cat4" => "%{[body][cat4]}"
        # "cat5" => "%{[body][cat5]}"
        # "cat6" => "%{[body][cat6]}"
        # "cat7" => "%{[body][cat7]}"
        # "cat8" => "%{[body][cat8]}"
        # "accessory_check" => "%{[body][accessory_check]}"
                          "classifier.version" => "${CLASSIFIER_LATEST_VERSION}"
        # }
                    remove_field => ["body","headers","@timestamp","@version"]
                }
            }
        
        
            if [body][cat1] {
                     mutate{ add_field => {"cat1" => "%{[body][cat1]}"} }
                } else {
                    mutate{ add_field => {"cat1" => ""} }
                }
        
            if [body][cat2] {
                 mutate{ add_field => {"cat2" => "%{[body][cat2]}"} }
            } else {
                mutate{ add_field => {"cat2" => ""} }
            }
          // and others 
    }

```

but as you can see its ugly. I wonder is there any alternative that reaches me to the same goal?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 19, 2023, 11:06pm UTC](https://discuss.elastic.co/t/how-to-handle-default-value-for-logstash-pipeline-efficiently/330335/2 "2023-04-19T23:06:57Z")

</div>

I would use

```
    ruby {
        code => '
            event.to_hash.each { |k, v|
                if /^cat\d/.match(k) and /%{[^}]+}/.match(v); event.set(k, ""); end
            }
        '
    }

```

---

<div class="post-metadata">

**Author:** ![Hatef\_Alipour](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hatef_alipour/32/120012_2.png) [@Hatef\_Alipour](https://discuss.elastic.co/u/Hatef_Alipour)\
**Post date:** [April 22, 2023, 8:19am UTC](https://discuss.elastic.co/t/how-to-handle-default-value-for-logstash-pipeline-efficiently/330335/3 "2023-04-22T08:19:22Z")

</div>

> [@Badger](#):
>
> `event.to_hash`

very neat, thank you so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2023, 8:20am UTC](https://discuss.elastic.co/t/how-to-handle-default-value-for-logstash-pipeline-efficiently/330335/4 "2023-05-20T08:20:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.