Painless script to add value to array if its exists

Elastic Stack Logstash
1

Hello, i have an input with ( besides other data) 2 Arrays , event_type and duration_ms.

i use logstash to update the document with this data. Because i don't want to loose the data from event_type and duration, i just add the values to an array in the original document.

My Problem is, that duration_ms does not always exist, therefore i am currently trying to add an if statement, because otherwise the script would fail.

my problem is, that with the current config:

output {
  elasticsearch {
    index => "kafka_import"
    action => "update"
    doc_as_upsert => "true"
    document_id => "%{click_uuid}"
    script => 'ctx._source.event_type.add("%{event_type}"); if(ctx._source.duration_ms != null) { ctx._source.duration_ms.add("%{duration_ms}");}'
  }
}

the output is

0, %{duration_ms}, %{duration_ms}, %{duration_ms}, %{duration_ms}, 9000, %{duration_ms}

Can someone point me into the right direction how to check if the field has a value?

2

can you create a variable=value if it does not exist on filter level
I have done this in one of the job. as some of the value was blank and it was getting rubyexception as I was trying to do some operation using ruby on that variable.

input {}
filter {
if ![variable] { mutate { update => { "variable" => "newvalue" } }
}
output {}

3

So, i found a solution

        script => 'ctx._source.event_type.add("%{event_type}"); if (params.event.get("duration_ms") != null) {if(ctx._source.duration_ms != null) {ctx._source.duration_ms.add("%{duration_ms}");}}'

the if (params.event.get("duration_ms") != null) checks if the variable is defined in the values the i use to upsert the document and the if(ctx._source.duration_ms != null) checks if the document that gets updated has already a field like this

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.