How to deal with optionals fields in Logstash/ElasticSearch -
i have problem when try import following xml file in elasticsearch logstash:
<test> <param name="param1" raw="0x01"> <param name="param2" raw="0x02" eng="2"> <param name="param3" raw="0x03" eng="3"> </test>
my logstash conf file following (extract):
xml { store_xml => false source => "message" xpath => [ "/test/param/@name", "name", "/test/param/@raw", "raw", "/test/param/@eng", "eng" ] }
after running logstash, elasticsearch database contains:
"name": [ "param1", "param2", "param3", ], "raw": [ "0x01", "0x02", "0x02", ], "eng": [ 2, 3, ],
i want this:
... "eng": [ null, 2, 3, ],
how can force null (or none or nan) value in non existing field ?
thanks in advance !
you can try add field if not exist, try following (place after xml filter) :
if ![eng] { mutate { add_field => { "eng" => "none" } } }
Comments
Post a Comment