Mutate add_field value null

Elastic Stack Logstash
1

Hi,

Is possible to add a field with value null, for example something like this:
Mutate{ add_field{"field1"=> null}}

I tried this, but added null like a string

Thanks!!

2

I suspect you need to use a ruby filter.

ruby { code => "event['nullfield'] = nil" }
3

Hi,

I tried using this in my code as mentioned below:

mutate{ rename=>{"add_user_name" => "userName"}}
if[userName] {
add_field=>{"assignedBy"=> "%{userName}"}}
add_field=>{"createdBy"=> "%{userName}"} }
}
else{
ruby { code => "event['assignedBy'] = nil" }
ruby { code => "event['createdBy'] = nil" }
}

But the data load from database is failing after this addition. (Only 3 rows are loaded out of some 70k rows). Kindly suggest. What am I missing here?

4

@sheilj, please start a new thread for your unrelated question.