I try to drop evets that "id" field is "empty-null OR not exist" in my json data. But it seems logstash doesn't work properly in if loop.
How can I achieve my purpose?
JSON File
{"id": "10","counter":"en","note":"note1"}
{"id": "10","counter":"en","note":"note1"}
{"counter":"en","note":"note1"}
Logstash Conf
input {
file {
type => "json"
path => "/data.json"
}
}
filter {
if ![id] or [id] == 'null' {
drop {}
}
}
......
Aucun commentaire:
Enregistrer un commentaire