# Logstash output to file, from JSON field not exist / field is empty, about output format

**URL:** <https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060>\
**Category:** Logstash\
**Created:** [August 13, 2018, 2:48am UTC](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060 "2018-08-13T02:48:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![richard20427176](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@richard20427176](https://discuss.elastic.co/u/richard20427176)\
**Post date:** [August 13, 2018, 2:48am UTC](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060/1 "2018-08-13T02:48:24Z")

</div>

I'm new in using logstash (6.3.2) to parse log data, I want to parse datas in json fmt from logs file to txt files. The steps of input and filter are ok, but there's some problem with output, below is the output section from my code snippet:

```auto
output {
    if [channel] == "brsdk" {
        file {
            codec => 
                line {
                    format => "%{bussiness}^^%{channel}^^%{[databody][name]}^^%{[databody][certNo]}^^%{[databody][eventType]}^^%{[databody][customerId]}^^%{[databody][mobile]}^^%{[databody][dataFrom]}"
                }
            path => "/data/log/logstash/%{+YYYYMM}/brsdk.%{+YYYYMMdd}.txt"
        }
    }
}

```

As you see, I parse data to text with JSON filed name mapping, but there's little problem, such as: if in JSON:

```auto
{"databody":{"certNo":"0222302X","customerId":663626902,"dataFrom":"baiqishi","eventType":"","name":"Lee"},"channel":"bqssdk","bussiness":"query"}

```

under the `databody` , the `eventType` field is empty, the `mobile` field is not exist, so in the output text looks like `[databody][mobile]` . my problems are:

1. If the field value is empty ( `eventType` ), how to export to text in form as two single quots: `''` ;

2. If the field not exist ( `mobile` ), how to export to text in form as two single quots: `''` ;

I don't know the output codec grammar clearly, and I can't find out some document from offical docs, so how to write in

```auto
file {
   codec => 
       line {}
}

```

Thanks

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 14, 2018, 11:18am UTC](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060/2 "2018-08-14T11:18:08Z")

</div>

Hi Richard,

Have you considered checking if the field exists in the filter section and then taking appropriate action on it?

> [@Add field only if its does not exists?](https://discuss.elastic.co/t/add-field-only-if-its-does-not-exists/54894):
>
> I expect this is common, but I can't seem to find any info on how to set a field /only/ if it does not already exist. I have tried translate: translate { field =\> "level" dictionary =\> ["DEBUG", "DEBUG", "INFO", "INFO", "WARN", "WARN", "ERR", "ERROR"] fallback =\> "INFO" exact =\> true } But when 'level' does not exist the fallback does not trigger. I've also tried: if "" in [level] { mutate { add\_field =\> { "level" =\> "INFO" } } } And if [level] ==…

> **[Accessing event data and fields | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)**

So, you can add a value to the field if it does not exist.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2018, 11:18am UTC](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060/3 "2018-09-11T11:18:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.