# Replace empty strings with Ruby code

**URL:** <https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590>\
**Category:** Logstash\
**Created:** [November 5, 2019, 10:46am UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590 "2019-11-05T10:46:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinay.rao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinay.rao/32/49894_2.png) [@vinay.rao](https://discuss.elastic.co/u/vinay.rao)\
**Post date:** [November 5, 2019, 10:46am UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/1 "2019-11-05T10:46:47Z")

</div>

Dear All,

I am here seeking your help on the following. I have empty strings in fields and i need to replace it with NULL or NILL .

Since am very new to Ruby, Can you help me with the complete query to achieve the above case.

Thanks in advance,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 5, 2019, 4:52pm UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/2 "2019-11-05T16:52:49Z")

</div>

You could try

```
    ruby {
        code => '
            event.to_hash.each { |k, v|
                if v == ""
                    event.set(k, "NULL")
                end
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![vinay.rao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinay.rao/32/49894_2.png) [@vinay.rao](https://discuss.elastic.co/u/vinay.rao)\
**Post date:** [November 6, 2019, 12:46pm UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/3 "2019-11-06T12:46:33Z")

</div>

> [@Badger](#):
>
> ruby { code =\> ' event.to\_hash.each { |k, v| if v == "" event.set(k, "NULL") end } ' }

Dear Badger,

Thanks for your update and solution. i have tried with the code which you provided, But there is no luck. Still am getting Empty string in fields.  
am attaching the Output and my logstash config file for your reference. Please let me know where i have to do the changes in the query or config file. Thanks in advance. ![Output](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ecde2c680a524cc2e05d80494da2ba309204867f.jpeg)

 ![Ruby%20query](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56a6426f2bd28e1d114a421f4294e3d30be03575.jpeg)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 6, 2019, 2:46pm UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/4 "2019-11-06T14:46:58Z")

</div>

I would guess that you want to add the ruby filter after the split, and that you do not want to do the tests at the top level but inside some field.

---

<div class="post-metadata">

**Author:** ![vinay.rao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinay.rao/32/49894_2.png) [@vinay.rao](https://discuss.elastic.co/u/vinay.rao)\
**Post date:** [November 7, 2019, 8:15am UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/5 "2019-11-07T08:15:22Z")

</div>

Dear Badger,

Thank you for guiding on the new workaround.  
But again no luck.☹ Even after putting the code after split empty strings are not replaced with NULL.

Even i have tried with other workarounds but nothing is working.  
Kindly let me know where i am lagging in getting the output or if there any alternative ruby code. Thanks in Advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 7, 2019, 3:47pm UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/6 "2019-11-07T15:47:39Z")

</div>

You haven't shown us what the data looks like. What does a complete event look like in rubydebug?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2019, 3:47pm UTC](https://discuss.elastic.co/t/replace-empty-strings-with-ruby-code/206590/7 "2019-12-05T15:47:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.