Sprintf with undefined field

I'm setting the document_id in a logstash to elasticsearch output module to a string made up of 2 of my fields, but i'm finding that when one field is null or undefined the name of the field just gets included in the string.

document_id => "%{[user_id]}-%{[group_id]}"

for instance if user_id is "123456" then document_id ends up being 123456-%{[group_id]} if group_id is undefined or null. am i doing something wrong? i'd prefer it to just be "null", or nothing, or even "undefined".

No, that's just how it works. You could test for the existence of the field and set it to null

if ! [group_id] { mutate { add_field => { "group_id" => "someValue" } } }
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.