Mutate and empty values

(James Privett) #1


I'm using the mutate plugin to remove square brackets i'm getting while trying to transform an XML file into a json file

mutate { replace => ["checkInFrom", "%{[checkInFrom][0]}"] }

This is working well. The only issue I have is that if the checkInForm value is empty or does not exists i'm getting the following JSON output


I would like to be able to remove the checkInFrom key from the JSON result if it does not exists. Is this possible? This is what I have tried so far

if ["checkInFrom"] == "" {
mutate { remove_field => ["checkInFrom"] }
mutate { replace => ["checkInFrom", "%{[checkInFrom][0]}"] }


(Magnus B├Ąck) #2

How about this:

if [checkInFrom] {
  mutate {

(James Privett) #3

I'm sure I tried that before but yes it does seem to work.

Thanks very much

(system) #4