Regarding if else condition for grok filter

Hi @sudhagar_ramesh @Badger

I have 1 date field in my oracle db. If the date field value is empty then I am getting grokparsefailure error as I am doing grok on that value.
I need to put 1 condition like if date is nil/empty then need to assign default null/nil value and if value is there, then assign that value.

"tags" => [
[0] "_grokparsefailure"

Could you please help me how to add condition sothat error should not come?

Suresh U.

If your field named "date" is missing, you can add as timestemp or value as you wish.
Also it's possible to set date as optional field in grok pattern: (%{TIMESTAMP_ISO8601:date})?

 if ![date] {
    mutate { add_field => { "date" => "%{@timestemp}" } }
1 Like

Hi @Rios

Instead of setting current timestamp, can we set null or nil or empty?

Could you please advice?


Depend how date is coming, you can set to:

I tried to give "" empty string. but getting the below exception:

:response=>{"index"=>{"_index"=>"testsit2veritassyncupdata45", "_type"=>"_doc", "_id"=>"284065", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [delivery_date] of type [date] in document with id '284065'. Preview of field's value: ''", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"cannot parse empty date"}}}}}

thank you so much @Rios I will try and will update.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.