Logstash null fields to drop

Elastic Stack Logstash
1

if i have 2 fields i want a condition
if [field1] == nil and [field2] == nil {
drop{}
}
if both fieds are null values i want to drop the event but none of the conditions i tried worked
[field1] == "" and [field2] == ""
"" in [field1] and "" in [field2]
[

1 Like
2

If they are actually nil then you could use

if ![a] and ![b] { drop {} }
1 Like
3

thank you so much and i want to ask you does the drop filter reduce logstash's performance?

4

Not processing data is faster than processing data, so I would say it does not. Just do the drop as early as possible.

5

okay thank you

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.