Mutate add_field gives sprint f format for nil values. How to solve this?

Elastic Stack Logstash
1

Hi All

I am using mutate add_field in my confile

mutate {
add_field => {"CloserName" => "%{[Bugs]CloserName}"}
    }

The value for many CloserName is null but some has value
Which ever record is having null values, i am not getting null instead i am getting sprintf
format.
i get the output like this
%{[Bugs]CloserName}

I can use If condition to solve for one column, i have 200 columns like this, i cannot write if condition for each of these newly added field.

I think this will be common problem, please let me know if someone is having solution for this?

2

That is not a valid sprintf reference. Is CloserName and field within the [Bugs] object? If so, use

%{[Bugs][CloserName]}

If it still does not work, configure

output { stdout { codec => rubydebug } }

and show us what an event looks like.

3

Hi @Badger

I tried your suggested sprintf, still i get the same value. Pasting the json from kibana

{
"_index": "sdfdsfff",
"_type": "logs",
"_id": "AWrCP3j9UCagDdWuJhQ7",
"_score": 1,
"_source": {
"BugTypeName": "Support",
"Status": "Under Review",
"Severity": "Normal",
"CloserName": "%{[Bugs][CloserName]}",
"@timestamp": "2019-05-16T20:05:04.413Z",
"DaysOpened": "6",
"BugNumber": "1010",
"@version": "1",
"DateModified": "5/10/2019 3:19 AM"
},
"fields": {
"@timestamp": [
1558037104413
]
}
}

This is what i am using in conf file

add_field => {"CloserName" => "%{[Bugs][CloserName]}"}

Under Bugs, this is how my value looks like, i am just parsing it to new field

[
{
.............
.
.

    "CloserName": null,
    "DaysOpened": "8",
    "ReportedVersionID": null,
    "BugsSeverityID": "38522",
   .
 .
 .
  },

{

}

]

4

OK, so that event does not have a [Bugs][CloserName] field, so you should expect the mutate to leave it with the sprintf reference. You could use something like this to remove any fields whose value starts with "%{".

1 Like
5

Thanks @Badger, from the linked topic, i got my solution

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.