# Logstash mutate - convert empty string to null
**URL:** https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263
**Category:** Logstash
**Created:** [June 29, 2017, 10:11am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263 "2017-06-29T10:11:22Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@selivan](https://discuss.elastic.co/u/selivan)
#### Post date: [June 29, 2017, 10:11am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263/1 "2017-06-29T10:11:22Z")
There is a field in log file, which contains IP address or empty string if IP address is not available.
Elasticsearch index has mapping, that maps "ip" type to this field. When field value is empty string, logstash can not save data to index:
`[WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch`
`...`
`"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [doc.ip]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"'' is not an IP string literal."}}}}}`
To fix this, I need to convert empty string to null with logstash. This doesn't work:
```
if [doc][ip] == "" {
mutate {
replace => { "[doc][ip]" => null }
}
}
```
Because it converts value to string "null". "nil" doesn't work either.
What is correct syntax to convert field to null value?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2017, 10:20am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263/2 "2017-06-29T10:20:21Z")
The Logstash configuration language doesn't support null values. You'll have to use a ruby filter. Or could you just remove the field?
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [June 29, 2017, 10:25am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263/3 "2017-06-29T10:25:19Z")
Why not just delete the field? It's more straightforward than trying to force null values from the logstash side.
```auto
if [doc][ip] == "" {
mutate {
remove_field => ["[doc][ip]"]
}
}
```
You could also take a look on [this mapping setting](https://www.elastic.co/guide/en/elasticsearch/reference/current/null-value.html)
---
### Author:  [@selivan](https://discuss.elastic.co/u/selivan)
#### Post date: [June 29, 2017, 11:04am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263/4 "2017-06-29T11:04:27Z")
Thank you, @paz and @magnusbaeck. Removing the field instead of setting it to null solves the problem 👍
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2017, 11:04am UTC](https://discuss.elastic.co/t/logstash-mutate-convert-empty-string-to-null/91263/5 "2017-07-27T11:04:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.