# Kv filter doubts **URL:** \ **Category:** Logstash\ **Created:** [June 21, 2018, 12:27pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846 "2018-06-21T12:27:25Z")\ **Posts on this page:** 16\ **Page:** 2
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 4, 2018, 5:57am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/21 "2018-07-04T05:57:10Z")
can you please provide me with the link for logstash documentation ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 4, 2018, 9:52am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/22 "2018-07-04T09:52:18Z")
Seriously? Googling "logstash upgrade plugin" doesn't result in relevant hits? ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 4, 2018, 10:13am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/23 "2018-07-04T10:13:46Z")
will check it ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 11, 2018, 7:16am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/24 "2018-07-11T07:16:05Z")
@magnusbaeck assume if the field is status=0, i can give the given the condition if ["status"]="0", but what if there is no field status at all. how do i give a "if" for that ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 11, 2018, 12:02pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/25 "2018-07-11T12:02:18Z")
See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals), specifically the section that starts with "You can check for the existence of a specific field". ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 18, 2018, 1:43pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/26 "2018-07-18T13:43:56Z")
Thanks it worked, if (![fieldname). ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 18, 2018, 1:45pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/27 "2018-07-18T13:45:52Z")
if a string is empty, how to check that? i tried using null and nil, it did not work ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 18, 2018, 2:28pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/28 "2018-07-18T14:28:17Z")
``` if [field] == "" { ``` ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 20, 2018, 10:06am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/29 "2018-07-20T10:06:27Z")
It did not work. No error was thrown but it tok the following characters after the "" as the value. e.g in the input log file -{"status": ""}{"userid":"tom"} after parsing -"status"=\>{"userid":"tom"} but the expected output is not this ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 20, 2018, 5:40pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/30 "2018-07-20T17:40:32Z")
I don't understand. Please show - an example line of input, - your Logstash configuration, - what Logstash produces with a `stdout { codec => rubydebug }` output, and - what you expected to get instead. ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 24, 2018, 10:34am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/31 "2018-07-24T10:34:00Z")
Input Logfile: CRM-WEB [INFO] 2018/03/22 00:03:33.717 Interface userInfo InputData:{"username":"bdh","errorcode":"0020"},OutputData:{"usernm":"aj","ido":"2125"} [Locale:English][URL:webpage] [c.c..ghij][webc:100] CRM-WEB [INFO] 2018/03/22 00:03:33.717 Interface userInfo InputData:{"username":"bdh","errorcode":""}OutputData:{"usernm":"aj","ido":"2125"} [Locale:English][URL:webpage] [c.c..ghij][web:010] Config file: input { file { path =\> "/home/murugar/Documents/checkpilot2.log" type =\> "file" start\_position =\> "beginning" sincedb\_path=\> "/dev/null" ``` } ``` } filter { ``` grok { match => ["message","%{DATA:applicationtype}\s\[%{LOGLEVEL:loglevel}\]\s\s%{DATA:logdate}\s\s\s%{GREEDYDATA:msg}"] } if "_grokparsefailure" in [tags] { drop{} } kv { source => "msg" transform_key => "lowercase" field_split => "\]\[," value_split => ":=" } ``` date { match =\> ["logdate","yyyy/MM/dd HH:mm:ss.SSS"] target =\> "@timestamp" ``` } ``` if ["errorcode"] == "" { mutate { add\_field =\> {"ErrorDescription" =\> " No errorcode is present"} } } else if ["errorcode"] = "0020" { mutate { add\_field =\> {"ErrorDescription" =\> The error in networks"} } } else if ["errorcode"] == "003" { mutate { add\_field =\> {"ErrorDescription" =\> "Time is blank or wrong format"} } } (exceptions go on) } output { stdout { codec =\> rubydebug } } The output in the console "message" =\> "CRM-WEB [INFO] 2018/03/22 00:03:33.717 Interface userInfo InputData:{"username":"bdh","errorcode":"0020"},OutputData:{"usernm":"aj","ido":"2125"} [Locale:English][URL:webpage] [c.c..ghij][webc:100]", "@version" =\> "1", "@timestamp" =\> "2018-03-22T04:03:33.717Z", "path" =\> "/home/murugar/Documents/checkpilot2.log", "host" =\> "0.0.0.0", "type" =\> "file", "applicationtype" =\> "CRM-WEB", "loglevel" =\> "INFO", "logdate" =\> "2018/03/22 00:03:33.717", "msg" =\> "Interface userInfo InputData:{"username":"bdh","errorcode":"0020"},OutputData:{"usernm":"aj","ido":"2125"} [Locale:English][URL:webpage] [c.c..ghij][webc:100]", "Interface userInfo InputData" =\> "{"username":"bdh"", ""errorcode"" =\> "0020", "OutputData" =\> "{"usernm":"aj"", ""ido"" =\> "2125", "Locale" =\> "English", "URL" =\> "webpage", "webc" =\> "100", "ErrorDescription" =\> "Error in networks" "message" =\> "RM-WEB [INFO] 2018/03/22 00:03:33.717 Interface userInfo InputData:{"username":"bdh","errorcode":""}OutputData:{"usernm":"aj","ido":"2125"} [Locale:English][URL:webpage] [c.c..ghij][web:010]", "@version" =\> "1", "@timestamp" =\> "2018-03-22T04:03:33.717Z", "path" =\> "/home/murugar/Documents/checkpilot2.log", "host" =\> "0.0.0.0", "type" =\> "file", "applicationtype" =\> "RM-WEB", "loglevel" =\> "INFO", "logdate" =\> "2018/03/22 00:03:33.717", "msg" =\> "Interface userInfo InputData:{"username":"bdh","errorcode":""}OutputData:{"usernm":"aj","ido":"2125"} [Locale:English][URL:webpage] [c.c..ghij][web:010]", "Interface userInfo InputData" =\> "{"username":"bdh"", ""errorcode"" =\> """}OutputData:{"usernm":"aj"", ""ido"" =\> "2125", "Locale" =\> "English", "URL" =\> "webpage", "web" =\> "010" Expected Output: the field "ErrorDescrition" =\> "No errorcode is present" should be in the second snippet but that field is not added. rest of the output is fine ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 25, 2018, 7:57pm UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/32 "2018-07-25T19:57:25Z")
> the field "ErrorDescrition" =\> "No errorcode is present" should be in the second snippet but that field is not added. Right, because `msg` contains `"errorcode":""` instead of `"errorcode":"0020"`. Do you expect error code to propagate from one message to the next? Or why would you expect the second event to get the same `errorcode` value as the first one? ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 30, 2018, 5:55am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/33 "2018-07-30T05:55:12Z")
Magnus it is not about the rror code vale. Error code values are already present in the given input log file. If errorcode:"", then that corressponding if condition should be executed which is the addition of error description: no errorcode is present. Why isnt that if condition is executed. There is no control over error values. Those are predefined in the input log files. But the corresponding "if conditions" for the error values should be executed accordingly. why is it not happening in the second snippet case? ---
**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Post date:** [July 30, 2018, 5:57am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/34 "2018-07-30T05:57:58Z")
For errorcode:0020, i got the field error description field which reads "errror in networks" as shown is rubydebug output but why not for the second case which should read as " no errorcode is present" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 1, 2018, 6:03am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/35 "2018-08-01T06:03:15Z")
> ``` > if ["errorcode"] == "" > > ``` That's the wrong syntax. Change to: ``` if [errorcode] == "" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2018, 6:09am UTC](https://discuss.elastic.co/t/kv-filter-doubts/136846/36 "2018-08-29T06:09:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/kv-filter-doubts/136846.md?page=1)