# Sprintf with undefined field

**URL:** <https://discuss.elastic.co/t/sprintf-with-undefined-field/234628>\
**Category:** Logstash\
**Created:** [May 27, 2020, 10:39pm UTC](https://discuss.elastic.co/t/sprintf-with-undefined-field/234628 "2020-05-27T22:39:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![steevhise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steevhise/32/41458_2.png) [@steevhise](https://discuss.elastic.co/u/steevhise)\
**Post date:** [May 27, 2020, 10:39pm UTC](https://discuss.elastic.co/t/sprintf-with-undefined-field/234628/1 "2020-05-27T22:39:25Z")

</div>

I'm setting the document\_id in a logstash to elasticsearch output module to a string made up of 2 of my fields, but i'm finding that when one field is null or undefined the name of the field just gets included in the string.

`document_id => "%{[user_id]}-%{[group_id]}"`

for instance if user\_id is "123456" then document\_id ends up being `123456-%{[group_id]}` if group\_id is undefined or null. am i doing something wrong? i'd prefer it to just be "null", or nothing, or even "undefined".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 27, 2020, 11:55pm UTC](https://discuss.elastic.co/t/sprintf-with-undefined-field/234628/2 "2020-05-27T23:55:04Z")

</div>

> [@steevhise](#):
>
> am i doing something wrong?

No, that's just how it works. You could test for the existence of the field and set it to null

```
if ! [group_id] { mutate { add_field => { "group_id" => "someValue" } } }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2020, 11:55pm UTC](https://discuss.elastic.co/t/sprintf-with-undefined-field/234628/3 "2020-06-24T23:55:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.