Syntax for Pipeline Processor Condition in Kibana

I would like to write a pipeline that drops the field "A" from a document when its value is the string "None". I want to do this in the Kibana UI.

I figure I need a Remove processor when runs on the condition that A == "None". I'm at this point in the UI.

What should I type in the "Condition" box? I've tried various combinations of A == "None" with different quotation mark arrangements and either they don't parse or have no effect.

So you should probably read about conditionals

Basically you put in what is between the double quotes so for

   {
      "set": {
        "field": "test",
        "value": "25",
        "if": "ctx.other_field == 'test'"
      }
    }

so try

ctx.other_field == 'test'

The ctx is the ingest processor context

From the example

"if": "ctx?.network?.name == 'Guest'"

you would enter

ctx?.network?.name == 'Guest'

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.