Not write to Elastic search if filed is null

Elastic Stack Logstash
1

My log parsed by logstash with some fields are null string, message is like this:
USR: NA, SID: null ....

So SID is null, how to not write to ELK if field is "null" ?
SID null

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.