# Update a field if it does not contain any value **URL:** \ **Category:** Logstash\ **Created:** [August 16, 2021, 3:28pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565 "2021-08-16T15:28:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Derya\_Sayar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/derya_sayar/32/78541_2.png) [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Post date:** [August 16, 2021, 3:28pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/1 "2021-08-16T15:28:31Z")
I have log files generated from some applications. Some of applications produces messages in following format. So there is "logContent" in message field. ``` {"instant":{"epochSecond":1628692763,"nanoOfSecond":792000000},"thread":"AWT-EventQueue-0","level":"INFO","loggerName":"com.client.logon.form.Logon","message":"errortype: SECURITY logContent:User Log on user 1","endOfBatch":false,"loggerFqcn":"org.apache.logging.log4j.spi.AbstractLogger","threadId":23,"threadPriority":6,"@timestamp":"2021-08-11T17:39:01.025+0300"} ``` some of applications produces logs in following format. There is no logContent text in message field `{"@timestamp":"2021-08-16T18:16:23.925+03:00","sequence":3042,"loggerClassName":"org.jboss.logmanager.Logger","loggerName":"stdout","level":"INFO","message":"\t\tCLIENT_UNIQUE_ID:e9d58a5e-67b8-4a11-88b8-71067cea4111","threadName":"EJB default - 1","threadId":357,"mdc":{},"ndc":"","hostName":"evt06001nb","processName":"jboss-modules.jar","processId":18888,"@version":"1"}` I am using Kibana for viewing logs. I want to show a single field in Dashboard. Otherwise it will be complicated for users to look at "logContent" and "message" fields at the same time. So I want to add a check to logstash that if logContent does not have any value , update its value to reflect message field. In discover, I will use "logContent" field. I implemented following if condition . But it did not work ````auto filter{ json{ source => "message" } grok { match => { "message" => [ "errortype:%{GREEDYDATA:errorType} logContent:%{GREEDYDATA:logContent}", "logContent:%{GREEDYDATA:logContent}" ] } } if ![logContent] { mutate { update => { "logContent" => "%{[message][message]}" } } } }``` ```` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2021, 4:35pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/2 "2021-08-16T16:35:06Z")
> [@Derya\_Sayar](#): > > `update => { "logContent" => "%{[message][message]}" }` What do you expect that to do? ---
**Author:** ![Derya\_Sayar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/derya_sayar/32/78541_2.png) [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Post date:** [August 16, 2021, 6:27pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/3 "2021-08-16T18:27:07Z")
for the following json log, I expect to assign "\t\tCLIENT\_UNIQUE\_ID:e9d58a5e-67b8-4a11-88b8-71067cea4111" for logContent. It is stored in "message" attribute of json ```auto {"@timestamp":"2021-08-16T18:16:23.925+03:00","sequence":3042,"loggerClassName":"org.jboss.logmanager.Logger","loggerName":"stdout","level":"INFO","message":"\t\tCLIENT_UNIQUE_ID:e9d58a5e-67b8-4a11-88b8-71067cea4111","threadName":"EJB default - 1","threadId":357,"mdc":{},"ndc":"","hostName":"evt06001nb","processName":"jboss-modules.jar","processId":18888,"@version":"1"} ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2021, 7:00pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/4 "2021-08-16T19:00:25Z")
> [@Derya\_Sayar](#): > > It is stored in "message" attribute of json Yes, and if you parse that JSON using a json filter then the [message] field will get overwritten ``` "ndc" => "", "message" => "\t\tCLIENT_UNIQUE_ID:e9d58a5e-67b8-4a11-88b8-71067cea4111", "level" => "INFO", "threadName" => "EJB default - 1" ``` etc. ---
**Author:** ![Derya\_Sayar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/derya_sayar/32/78541_2.png) [@Derya\_Sayar](https://discuss.elastic.co/u/Derya_Sayar)\ **Post date:** [August 16, 2021, 7:24pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/5 "2021-08-16T19:24:07Z")
So you mean following should work. But it does not. Do you think if condition is problem? Does it mean that if logContent is empty? ```auto if ![logContent] { mutate { update => { "logContent" => "message" } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2021, 7:34pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/6 "2021-08-16T19:34:02Z")
mutate+update does nothing if a field does not exist. If you want to set logContent to the value of [message] when logContent is empty then use ``` if ! [logContent] { mutate { add_field => { "logContent" => "%{message}" } } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 13, 2021, 7:34pm UTC](https://discuss.elastic.co/t/update-a-field-if-it-does-not-contain-any-value/281565/7 "2021-09-13T19:34:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.