Logstash output to file, from JSON field not exist / field is empty, about output format

[NerdSec (Nachiket)]

Hi Richard,

Have you considered checking if the field exists in the filter section and then taking appropriate action on it?

Add field only if its does not exists?

I expect this is common, but I can't seem to find any info on how to set a field /only/ if it does not already exist. I have tried translate: translate { field => "level" dictionary => [ "DEBUG", "DEBUG", "INFO", "INFO", "WARN", "WARN", "ERR", "ERROR" ] fallback => "INFO" exact => true } But when 'level' does not exist the fallback does not trigger. I've also tried: if "" in [level] { mutate { add_field => { "level" => "INFO" } } } And if [level] ==…

Accessing event data and fields | Logstash Reference [8.11] | Elastic

So, you can add a value to the field if it does not exist.