# Replace empty field with a value
**URL:** https://discuss.elastic.co/t/replace-empty-field-with-a-value/114723
**Category:** Logstash
**Created:** [January 9, 2018, 2:50pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-value/114723 "2018-01-09T14:50:02Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@cilzzz](https://discuss.elastic.co/u/cilzzz)
#### Post date: [January 9, 2018, 2:50pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-value/114723/1 "2018-01-09T14:50:02Z")
Hi,
I have a log file that contains a field called Status.
i have two values: one null and the other OK.
by null i mean there are no value.
in mu logstash config file i used :
```
mutate {
gsub => ["Status , " " , "Failed"]
}
```
i need to replace all the null values by Failed
i don't know why it didn't work
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [January 9, 2018, 3:43pm UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-value/114723/2 "2018-01-09T15:43:32Z")
Do this instead (see the if condition):
```auto
input {
generator {
message => '{"field1": "01", "field2": "", "Status": null}'
count => 1
}
}
filter {
json {
source => "message"
}
if ! [Status] {
mutate {
update => { "Status" => "Failed" }
}
}
}
output {
stdout {
codec => rubydebug
}
}
```
result
```auto
{
"sequence" => 0,
"@timestamp" => 2018-01-09T15:41:53.075Z,
"field1" => "01",
"field2" => "",
"Status" => "Failed",
"host" => "Elastics-MacBook-Pro.local",
"message" => "{\"field1\": \"01\", \"field2\": \"\", \"Status\": null}",
"@version" => "1"
}
```
---
### Author:  [@cilzzz](https://discuss.elastic.co/u/cilzzz)
#### Post date: [January 10, 2018, 8:37am UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-value/114723/3 "2018-01-10T08:37:54Z")
i will try it thank you !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2018, 8:39am UTC](https://discuss.elastic.co/t/replace-empty-field-with-a-value/114723/4 "2018-02-07T08:39:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.