I am adding a field that references another field, add_field => { "newfield" => "%{oldfield}"}.
Sometimes the referenced field is empty, resulting in newfield containing a string with the value %{oldfield}. How can I remove this string?
I've tried using mutate's gsub with pattern's "%{oldfield}", "%\{oldfield\}", and "\%\{oldfield\}"
I've also tried using IF with a regex expression and expressing it in string form but neither of them seems to work. Any ideas?
If the referenced field is empty I would expect add_field to add an empty field. I would only expect a field containing "%{oldfield}" if oldfield is missing on the event.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.