If I use logstash to parse XML with an self-closing tag (e.g. <foo />
), it turns it into an empty object instead of an empty string. For example:
"parsed" => {
"foo" => [
[0] {}
]
}
How can I add a conditional to only call add_field if it's a string, not an empty object? If I do this:
if [parsed][foo][0] {
mutate {
add_field => {
"foo" => "%{[parsed][foo][0]}"
}
}
}
the field "foo" gets the value "{}". I also tried checking if [parsed][foo][0] != "{}"
, but that didn't catch it.