# Logstash output to file, from JSON field not exist / field is empty, about output format

**URL:** <https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060>\
**Category:** Logstash\
**Created:** [August 13, 2018, 2:48am UTC](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060 "2018-08-13T02:48:24Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 14, 2018, 11:18am UTC](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060/2 "2018-08-14T11:18:08Z")

</div>

Hi Richard,

Have you considered checking if the field exists in the filter section and then taking appropriate action on it?

> [@Add field only if its does not exists?](https://discuss.elastic.co/t/add-field-only-if-its-does-not-exists/54894):
>
> I expect this is common, but I can't seem to find any info on how to set a field /only/ if it does not already exist. I have tried translate: translate { field =\> "level" dictionary =\> ["DEBUG", "DEBUG", "INFO", "INFO", "WARN", "WARN", "ERR", "ERROR"] fallback =\> "INFO" exact =\> true } But when 'level' does not exist the fallback does not trigger. I've also tried: if "" in [level] { mutate { add\_field =\> { "level" =\> "INFO" } } } And if [level] ==…

> **[Accessing event data and fields | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)**

So, you can add a value to the field if it does not exist.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-output-to-file-from-json-field-not-exist-field-is-empty-about-output-format/144060)._