Logstash nested conditional statement one with null check

Elastic Stack Logstash
1

As i am trying to write a script that as to populate the "Category" based on "Knowledge Title" contains some text called "AGSS", but here the condition is that i need to check the "Category" is null then only i have to proceed for other condition.
Please find the code snippet:

if [Category] { /* need to check the "Category is null */

	if "AGSS" in [Knowledge Title] {

		mutate {
			update => { "Category" => "SOFTWARE_MOD" }
		}
	}
}

In the above code is not able to check for null for "Category" field
I tried even the following one for null check:

if [Category] == nil
if [Category] == null
if [Category] != nil
if [Category] == "null"
if [Category] == "nil"

but none of them are working,

Can you please help me out how to check for a null for a particular field.
Thanks in advance.

2

How does null end up in the Category field?

You'll have to use a ruby filter to this kind of check. Logstash's own configuration language has no notion of "null".

3

Thanks Magnus.. for your help..

4

I have used the following method with success...

if [Category] !~ /.+/ { }

You may want to give it a try.

NOTE:
I have found this works ONLY with fields that are logstash strings. If the value is an integer (e.g. using something like...

mutate { convert => { "Category" => "integer" } }

... the regex match will not work. Ran into this quirk just this morning.

Rob

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.