Logstash null fields to drop

if i have 2 fields i want a condition
if [field1] == nil and [field2] == nil {
if both fieds are null values i want to drop the event but none of the conditions i tried worked
[field1] == "" and [field2] == ""
"" in [field1] and "" in [field2]

If they are actually nil then you could use

if ![a] and ![b] { drop {} }

thank you so much and i want to ask you does the drop filter reduce logstash's performance?

Not processing data is faster than processing data, so I would say it does not. Just do the drop as early as possible.

okay thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.