I have a log source which has messages where the fields are in the
I use the kv filter to parse it, and trim it by the apostrophes.
I noticed, however, that the empty fields are saved to Elasticsearch.
For example a field like
is saved as
As far as I know, empty values are not saved in Elaticsearch.
(And for another log source of mine it works fine and empty values are not saved. However, there I use Grok.)
If a field has no values, how is it stored in an inverted index?
That’s a trick question, because the answer is: it isn’t stored at all.
This is the kv filter I use:
exclude_keys => [ "transferId" ]
trim_value => "'"
Why are the empty fields saved if I use kv?