How to write NULL value for a field

Elastic Stack Logstash
1

We're ingesting some logfiles where the system writes a "-" for fields without value. I'd like to replace this with a proper NULL in order to keep data as clean as possible.

I've tried mutations with the following values:
[null]
nil

But these only show up as strings in my log.

So: How do I properly set a field value to NULL in logstash?

1 Like
2

The Logstash configuration language has no notion of null. You'll have to use a ruby filter. Something like

ruby {
  code => "event['name-of-field'] = nil if event['name-of-field'] == '-'"
}

should work

4 Likes