Logstash Replacing A Value

[motts]

I am working on filtering ftp logs that are in xml format. Everything works fine, but this one column that's labeled "host". If that column has data in it, that data will be put into elasticsearch. However, if that column has a blank spot, the source IP of the host that the xml is coming from goes into that spot instead of it being left blank

I have tried to use

replace => {"host: 1.1.1.1" => "host: N/A"}

but logs do not ship at all. When I check the logstash logs, there is an error in there that says Filed names cannot use periods.

Do you have a way you recommend I replace that value with N/A or even a blank space, if the value is equal to the shipping host IP?

[Badger]

Logstash events have a field called host, which is set to the name of the machine it runs on. You are overwriting that sometimes. If you do not overwrite it then it keeps the value it started with. You could try using a different field name for the data you are trying to index. Or if you really insist

  if [host] == "1.1.1.1" {
    mutate { remove_field => ["host"] }
    mutate { add_field => { "host" => "NA" } }
  }

But I would definitely suggest using a different field if you can.