How to deal with optionals fields in Logstash/ElasticSearch -


i have problem when try import following xml file in elasticsearch logstash:

<test> <param name="param1" raw="0x01"> <param name="param2" raw="0x02" eng="2"> <param name="param3" raw="0x03" eng="3"> </test> 

my logstash conf file following (extract):

xml {     store_xml => false     source => "message"     xpath => [         "/test/param/@name", "name",         "/test/param/@raw", "raw",         "/test/param/@eng", "eng"     ] } 

after running logstash, elasticsearch database contains:

"name": [       "param1",       "param2",       "param3",     ], "raw": [       "0x01",       "0x02",       "0x02",     ], "eng": [       2,       3,     ], 

i want this:

... "eng": [       null,       2,       3,     ], 

how can force null (or none or nan) value in non existing field ?

thanks in advance !

you can try add field if not exist, try following (place after xml filter) :

  if ![eng] {     mutate { add_field => { "eng" => "none" } }   } 

mutate filter plugin


Comments

Popular posts from this blog

php - Vagrant up error - Uncaught Reflection Exception: Class DOMDocument does not exist -

vue.js - Create hooks for automated testing -

Add new key value to json node in java -