Mutate and empty values

Elastic Stack Logstash
1

Hi,

I'm using the mutate plugin to remove square brackets i'm getting while trying to transform an XML file into a json file

mutate { replace => ["checkInFrom", "%{[checkInFrom][0]}"] }

This is working well. The only issue I have is that if the checkInForm value is empty or does not exists i'm getting the following JSON output

"checkInFrom":"%{[checkInFrom][0]}"

I would like to be able to remove the checkInFrom key from the JSON result if it does not exists. Is this possible? This is what I have tried so far

if ["checkInFrom"] == "" {
mutate { remove_field => ["checkInFrom"] }
}else{
mutate { replace => ["checkInFrom", "%{[checkInFrom][0]}"] }
}

Thanks

2

How about this:

if [checkInFrom] {
  mutate {
    ...
  }
}
3

I'm sure I tried that before but yes it does seem to work.

Thanks very much