Splitting field in logstash

[Nisha.MP (Nisha)]

Hi
I'm trying to split a particular field in CloudTrail log and this is my filter pattern
filter{
json{
source => "message"
}
split{
field => "resources"
add_tag => "splitted"
} }
This is working when the field named "resources" exists in the logs. When the logs doesn't contains this field, getting an error [WARN ][logstash.filters.split ][main] Only String and Array types are splittable. field:resources is of type = NilClass.
I need help to rewrite the filter pattern to handle this exception and so to avoid getting the above given error log.

[Marta_Zagrajek]

@Nisha.MP please include your sample log file

[andres-perez (Andrés Pérez)]

@Nisha.MP

This is working when the field named "resources" exists in the logs. When the logs doesn't contains this field, getting an error ...

So you could execute the filter inside a conditional block that checks the existence of resources field

if [resources] {
    split { ... }
}

[Nisha.MP (Nisha)]

Yup that worked. Thanks a bunch!!!