Finally, this is my workaround, ugly hack as mentioned here:
(btw, i'm gentunian answering that post, a little bit of my own medicine)
input {
http { port => 9443 }
}
filter {
mutate {
convert => { "sa_manual" => "string" }
}
# Now we are sure sa_manual does not exist if this condition is true
if ![sa_manual] {
mutate {
add_field => { "sa_manual" => false }
}
}
# at this stage, we are sure sa_manual exists in the pipeline
mutate {
convert => { "sa_manual" => "boolean" }
}
}
output { stdout {} }