Replace empty strings with Ruby code

Elastic Stack Logstash
1

Dear All,

I am here seeking your help on the following. I have empty strings in fields and i need to replace it with NULL or NILL .

Since am very new to Ruby, Can you help me with the complete query to achieve the above case.

Thanks in advance,

2

You could try

    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v == ""
                    event.set(k, "NULL")
                end
            }
        '
    }
1 Like
3

Dear Badger,

Thanks for your update and solution. i have tried with the code which you provided, But there is no luck. Still am getting Empty string in fields.
am attaching the Output and my logstash config file for your reference. Please let me know where i have to do the changes in the query or config file. Thanks in advance.Output

Ruby%20query
Ruby%20query544×688 43.2 KB

4

I would guess that you want to add the ruby filter after the split, and that you do not want to do the tests at the top level but inside some field.

5

Dear Badger,

Thank you for guiding on the new workaround.
But again no luck.:frowning: Even after putting the code after split empty strings are not replaced with NULL.

Even i have tried with other workarounds but nothing is working.
Kindly let me know where i am lagging in getting the output or if there any alternative ruby code. Thanks in Advance.

6

You haven't shown us what the data looks like. What does a complete event look like in rubydebug?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.