Sprintf with undefined field

[steevhise]

I'm setting the document_id in a logstash to elasticsearch output module to a string made up of 2 of my fields, but i'm finding that when one field is null or undefined the name of the field just gets included in the string.

document_id => "%{[user_id]}-%{[group_id]}"

for instance if user_id is "123456" then document_id ends up being 123456-%{[group_id]} if group_id is undefined or null. am i doing something wrong? i'd prefer it to just be "null", or nothing, or even "undefined".

[Badger]

@steevhise

am i doing something wrong?

No, that's just how it works. You could test for the existence of the field and set it to null

if ! [group_id] { mutate { add_field => { "group_id" => "someValue" } } }