# Regarding if else condition for grok filter
**URL:** https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863
**Category:** Logstash
**Created:** [July 5, 2022, 6:53am UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863 "2022-07-05T06:53:29Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [July 5, 2022, 6:53am UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/1 "2022-07-05T06:53:29Z")
Hi @sudhagar_ramesh @Badger
I have 1 date field in my oracle db. If the date field value is empty then I am getting **grokparsefailure** error as I am doing grok on that value.
I need to put 1 condition like if date is nil/empty then need to assign default null/nil value and if value is there, then assign that value.
{
"tags" =\> [
[0] "\_grokparsefailure"
],
}
Could you please help me how to add condition sothat error should not come?
Thanks,
Suresh U.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 5, 2022, 8:18am UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/2 "2022-07-05T08:18:34Z")
If your field named "date" is missing, you can add as timestemp or value as you wish.
Also it's possible to set date as optional field in grok pattern: (%{TIMESTAMP\_ISO8601:date})?
```auto
if ![date] {
mutate { add_field => { "date" => "%{@timestemp}" } }
}
```
---
### Author:  [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [July 5, 2022, 8:21am UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/3 "2022-07-05T08:21:46Z")
Hi @Rios
Instead of setting current timestamp, can we set null or nil or empty?
Could you please advice?
Thanks.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/4 "2022-07-05T08:27:50Z")
Depend how date is coming, you can set to:
- Empty string
if ![date] {
mutate { add\_field =\> { "date" =\> "" } }
}
- Null string
if ![date] {
mutate { add\_field =\> { "date" =\> "Null" } }
}
- Or null value, use ruby inside if
[How to write NULL value for a field](https://discuss.elastic.co/t/how-to-write-null-value-for-a-field/53885)
[Change null value from database for one field using logstash and insert into Elasticsearch - #8 by malhotras](https://discuss.elastic.co/t/change-null-value-from-database-for-one-field-using-logstash-and-insert-into-elasticsearch/97552/8)
---
### Author:  [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [July 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/5 "2022-07-05T08:27:58Z")
I tried to give "" empty string. but getting the below exception:
**:response=\>{"index"=\>{"\_index"=\>"testsit2veritassyncupdata45", "\_type"=\>"\_doc", "\_id"=\>"284065", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse field [delivery\_date] of type [date] in document with id '284065'. Preview of field's value: ''", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"cannot parse empty date"}}}}}**
---
### Author:  [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [July 5, 2022, 2:11pm UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/6 "2022-07-05T14:11:39Z")
thank you so much @Rios I will try and will update.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2022, 2:12pm UTC](https://discuss.elastic.co/t/regarding-if-else-condition-for-grok-filter/308863/7 "2022-08-02T14:12:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.