Removing field reference in field as string value

Elastic Stack Logstash
1

I am adding a field that references another field, add_field => { "newfield" => "%{oldfield}"}.

Sometimes the referenced field is empty, resulting in newfield containing a string with the value %{oldfield}. How can I remove this string?

I've tried using mutate's gsub with pattern's "%{oldfield}", "%\{oldfield\}", and "\%\{oldfield\}"
I've also tried using IF with a regex expression and expressing it in string form but neither of them seems to work. Any ideas?

2

If the referenced field is empty I would expect add_field to add an empty field. I would only expect a field containing "%{oldfield}" if oldfield is missing on the event.

Can you use this?...

filter { if [newfield] == "%{oldfield}" { mutate { remove_field => "newfield" } } }