Space in field reference not working as intended

[BenJeau (Benoît Jeaurond)]

Hi,

I'd like to verify if a field (which contains a space) is present or not in a document and to drop it if its present (in the example below I just added a field to debug and see what/which statement works, but turns out none of them works). I tried different approach, all of them not working:

filter {
    if ![Total Events] {
        mutate {
            add_field => { "field_1" => True }
        }
    } 
    
    if [Total Events] {} else {
        mutate {
            add_field => { "field_2" => True }
        }
    }

    if !["Total Events"] {
        mutate {
            add_field => { "field_3" => True }
        }
    }

    if ![Total\ Events] {
        mutate {
            add_field => { "field_4" => True }
        }
    } 
}

In the resulting document, everything is True even on documents that do not have the field "Total Events". How would someone access the value of a field that has space in its name?

Thanks for your time

[Badger]

The first two work. The configuration

output { stdout { codec => rubydebug { metadata => false } } }
input { generator { count => 1 lines => [ '{ "a": "b" }', '{ "a": "b", "Total Events": "c" }' ] codec => json { } } }
filter {
    if ![Total Events] { mutate { add_field => { "field_1" => True } } }
    if [Total Events] {} else { mutate { add_field => { "field_2" => True } } }
    if !["Total Events"] { mutate { add_field => { "field_3" => True } } }
    if ![Total\ Events] { mutate { add_field => { "field_4" => True } } }
}

produces

{
   "field_1" => "True",
   "field_2" => "True",
   "field_3" => "True",
   "field_4" => "True",
         "a" => "b"
}
{
     "field_4" => "True",
     "field_3" => "True",
           "a" => "b",
"Total Events" => "c",
}

[BenJeau (Benoît Jeaurond)]

That is interesting - I was expecting the first two to work, so it's good to know that it works for you. The problem must be my source. I'm filtering an index, so the input is an index and the output is another index.

Edit: the field was misspelled and there was a problem with the source... At least it works now, thanks for trying it out