How to ignore fields is null when I combine them?


(Johnny) #1

This is my grok pattern

add_field => {
if [referer_url] == "-"
"referer" => "%{referer_req_method} %{referer_url}%{referer_url_querystring}"
}

e.g: this is perfect case
t referer GET http://localhost/v1/.misplaced_objects,?format=json&marker=&end_marker=
t referer_req_method GET
t referer_url http://localhost/v1/.misplaced_objects, -
t referer_url_querystring ?format=json&marker=&end_marker=

But some time 1 field is null, thus after combine, null field will be %{referer_url_querystring}
t referer HEAD http://xxx.com/v1/AUTH_xxx%{referer_url_querystring}
t referer_req_method HEAD
t referer_url http://xxx.com/v1/AUTH_xxx
t referer_url_querystring -

Or all of them are null then i will get %{referer_req_method} %{referer_url}%{referer_url_querystring}
referer %{referer_req_method} %{referer_url}%{referer_url_querystring}
t referer_req_method -
t referer_url -
t referer_url_querystring -

how can I ignore the field is null when i combine them ?


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.