How to tell if "tags" array is empty in LS 6

Elastic Stack Logstash
1

Hi,

The code here (How can I check if the "tags" array is empty?) used to work for checking if tags was empty or not.

if [tags] == [] {
  mutate {
    remove_field => ["tags"]
  }
}

Unfortunately, it no longer seems to work because I get the following error:

main, :exception=>"Java::JavaLang::IllegalArgumentException", :message=>"Failed to parse right-hand side of conditional [str]pipeline:1723:6:```\n[tags] == []\n```

If I remove the conditional, the error no longer occurs.

Is there a new LS6 compatible way to check if tags is empty?

Many thanks,
Nick

2

Have you tried if not [tags]?

3

Thanks Magnus,

Is that test looking to see if the tags field exists, rather than if it's empty? I put that code in specifically to remove the tags field if it contains no elements. In my configuration pipeline, it's possible that I've added values to [tags] and then removed them again by the end of processing.

I guess it's no biggy if tags in hanging around with nothing in it, but it would be nice if the configuration language supported this feature (again).

Cheers,
Nick

4

Hey Magnus. Does this check for empty tags field? We only want to remove tags field if it is empty. Thanks.

5

Does this check for empty tags field?

I believe so, yes.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.