Not write to Elastic search if filed is null

(Robert Chen) #1

My log parsed by logstash with some fields are null string, message is like this:
USR: NA, SID: null ....

So SID is null, how to not write to ELK if field is "null" ?
SID null

(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.