# Replace empty field with a meaning word

**URL:** <https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266>\
**Category:** Logstash\
**Created:** [October 23, 2022, 5:16am UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266 "2022-10-23T05:16:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Roger\_Huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roger_huang/32/106867_2.png) [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\
**Post date:** [October 23, 2022, 5:16am UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266/1 "2022-10-23T05:16:34Z")

</div>

Hi everyone,  
I am trying to replace empty fields instead of %{}  
So i used this code:

```auto
if ! [xxevent.fw_app_id] {
            mutate {
              update => { "xxevent.fw_app_id" => "EMPTY" }
            }
        }    

```

However, it did not replace all to "EMPTY". Is there a better way to do this?

![Screenshot 2022-10-23 at 1.09.35 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae7e487db79849eddca111e2e937ee67f75a6cd8.png)

My add\_field code:

```auto
 mutate { 
        add_field => { 
             "xxevent.fw_app_id" => "%{[XDRevent][fw_app_id]}"
             "xxfile.name" => "%{[XDRevent][action_file_name]}"
....

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 23, 2022, 1:07pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266/2 "2022-10-23T13:07:19Z")

</div>

What do you want with the xxevent.fw\_app\_id field?  
a) if not exist at all to replace with a field value for instance: [XDRevent][fw\_app\_id]  
b) if not exist at all to replace with value: EMPTY  
c) if exists but is zero string "", replace with value: EMPTY  
d) if exists but is NULL, replace with value: EMPTY  
e) other

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 23, 2022, 3:32pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266/3 "2022-10-23T15:32:48Z")

</div>

Can you share the json of the document in Kibana?

Is your field named `xxevent.fw_app_id` with a literal dot in its name or it is a json object where `fw_app_id` is nested under `xxevent`?

Those are completely different things and the way you refer to them in Logstash is different from the way you refer to them in Elasticsearch/Kibana.

---

<div class="post-metadata">

**Author:** ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\
**Post date:** [October 23, 2022, 4:23pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266/4 "2022-10-23T16:23:53Z")

</div>

The update mutation only works when the field exist  
In your first snipped code you are saying if the field doesn't exist then do an update. But because the field doesn't exist, it won't do anything.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2022, 4:24pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-meaning-word/317266/5 "2022-11-20T16:24:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.