Regarding if else condition for grok filter

[suresh_u]

Hi @sudhagar_ramesh @Badger

I have 1 date field in my oracle db. If the date field value is empty then I am getting grokparsefailure error as I am doing grok on that value.
I need to put 1 condition like if date is nil/empty then need to assign default null/nil value and if value is there, then assign that value.

{
"tags" => [
[0] "_grokparsefailure"
],
}

Could you please help me how to add condition sothat error should not come?

Thanks,
Suresh U.

[Rios]

If your field named "date" is missing, you can add as timestemp or value as you wish.
Also it's possible to set date as optional field in grok pattern: (%{TIMESTAMP_ISO8601:date})?

 if ![date] {
    mutate { add_field => { "date" => "%{@timestemp}" } }
  }

[suresh_u]

Hi @Rios

Instead of setting current timestamp, can we set null or nil or empty?

Could you please advice?

Thanks.

[Rios]

Depend how date is coming, you can set to:

• Empty string
  if ![date] {
  mutate { add_field => { "date" => "" } }
  }
• Null string
  if ![date] {
  mutate { add_field => { "date" => "Null" } }
  }
• Or null value, use ruby inside if
  How to write NULL value for a field
  Change null value from database for one field using logstash and insert into Elasticsearch - #8 by malhotras

[suresh_u]

I tried to give "" empty string. but getting the below exception:

:response=>{"index"=>{"_index"=>"testsit2veritassyncupdata45", "_type"=>"_doc", "_id"=>"284065", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [delivery_date] of type [date] in document with id '284065'. Preview of field's value: ''", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"cannot parse empty date"}}}}}

[suresh_u]

thank you so much @Rios I will try and will update.