How to overwrite message (set to minus) if it is not overwrited in grok?

Elastic Stack Logstash
8

You can remove the empty array using

ruby {
    code => '
        if event.get("tags") == []
            event.remove("tags")
        end
    ' 
}

And in the json filter, if you do not actually want the json parsed, parse into a sub-field of [@metadata]

json { source => "message" target => [@metadata][junk]" }