mercredi 30 décembre 2020

Logstash JSON file Check fields

I try to drop evets that "id" field is "empty-null OR not exist" in my json data. But it seems logstash doesn't work properly in if loop.

How can I achieve my purpose?

JSON File

{"id": "10","counter":"en","note":"note1"}
{"id": "10","counter":"en","note":"note1"}
{"counter":"en","note":"note1"}

Logstash Conf

input {
  file {
    type => "json"
    path => "/data.json"
  }
}

filter {
    if ![id] or [id] == 'null' {
        drop {}
    }
}
......

Aucun commentaire:

Enregistrer un commentaire