# Logstash convert Nil values into a number
**URL:** https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271
**Category:** Logstash
**Created:** [October 17, 2017, 3:57pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271 "2017-10-17T15:57:19Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Pinheiro](https://discuss.elastic.co/u/Pinheiro)
#### Post date: [October 17, 2017, 3:57pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/1 "2017-10-17T15:57:19Z")
Hello everyone,
I'm trying to find the fields that are empty and change them for a value.
I want to do something like the next expression, but Logstash can not find the nil value. Does anyone have a suggestion for finding and changing empty fields?
filter{
if [field] == nil {
mutate {
replace =\> { "field" =\> "99999" }
}
}
}
Thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 17, 2017, 6:46pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/2 "2017-10-17T18:46:14Z")
Empty meaning "contains an empty string" or "doesn't exist at all" or something else?
---
### Author:  [@Pinheiro](https://discuss.elastic.co/u/Pinheiro)
#### Post date: [October 18, 2017, 9:18am UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/3 "2017-10-18T09:18:08Z")
The original log is a semi-colon separated field and, for instance when you have 4 empty fields it's showed as ";;;" which is in fact are 4 empty strings but they are supposed to be 4 ints. Some of the field's values are "regular" int values (1,2,3,4), some have 0, but I want to replace the ones that don't have anything with 0 (zero).
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 18, 2017, 2:03pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/4 "2017-10-18T14:03:42Z")
In that case use `if [field] == "" {`.
---
### Author:  [@Pinheiro](https://discuss.elastic.co/u/Pinheiro)
#### Post date: [October 18, 2017, 2:39pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/5 "2017-10-18T14:39:33Z")
I try to use that expression but didn't change the values.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 18, 2017, 3:29pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/6 "2017-10-18T15:29:19Z")
Show an example document that doesn't end up as expected. Use a `stdout { codec => rubydebug }` output to dump the raw event.
---
### Author:  [@Pinheiro](https://discuss.elastic.co/u/Pinheiro)
#### Post date: [October 18, 2017, 4:52pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/7 "2017-10-18T16:52:10Z")
An example of the output:
"
"field" =\> nil,
"@version" =\> "1",
"field2" =\> 0,
"field3" =\> 0,
"field4" =\> 0,
"field5" =\> nil,
"field8" =\> 0,
"message" =\> "190123001;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;0;;;;;;;;;;;;;;;;;;;;;",
"ind\_filedate" =\> "20161118",
"field5" =\> nil,
"field6" =\> nil,
"field7" =\> nil,
"@timestamp" =\> 2016-11-18T00:00:00.000Z"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 18, 2017, 6:51pm UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/8 "2017-10-18T18:51:22Z")
Okay. I don't undertand how the nil ends up there, but try `if [field5] {`. If that doesn't work you'll have to use a ruby filter.
---
### Author:  [@Pinheiro](https://discuss.elastic.co/u/Pinheiro)
#### Post date: [October 19, 2017, 8:32am UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/9 "2017-10-19T08:32:21Z")
Didn't work also. I don't know ruby code this, can you post an example please?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 19, 2017, 9:18am UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/10 "2017-10-19T09:18:59Z")
Something like this should work:
```nohighlight
if event.get('field').nil?
event.set('field', 9999)
end
```
Lots of ruby filter examples have been posted here in the past.
---
### Author:  [@Pinheiro](https://discuss.elastic.co/u/Pinheiro)
#### Post date: [October 20, 2017, 8:46am UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/11 "2017-10-20T08:46:11Z")
That ruby code work perfectly. Thank you Magnus 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 17, 2017, 8:47am UTC](https://discuss.elastic.co/t/logstash-convert-nil-values-into-a-number/104271/12 "2017-11-17T08:47:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.