logstash check if field exists

问题

I have log files coming in to an ELK stack. I want to copy a field (foo) in order to perform various mutations on it, However the field (foo) isn't always present.

If foo doesn't exist, then bar still gets created, but is assigned the literal string "%{foo}"

How can I perform a mutation only if a field exists?

I'm trying to do something like this.

if ["foo"] {
  mutate {
    add_field => "bar" => "%{foo}
  }
}

回答1:

To check if field foo exists:

1) For numeric type fields use:

 if ([foo]) {
    ...
 }

2) For types other than numeric like boolean, string use:

if ("" in [foo]) {
    ...
}

回答2:

"foo" is a literal string.

[foo] is a field.

# technically anything that returns 'true', so good for numbers and basic strings:
if [foo] {
}

# contains a value
if [foo] =~ /.+/ {
}

回答3:

On Logstash 2.2.2, the ("" in [field]) construct does not appear to work for me.

if ![field] { }

does, for a non-numerical field.

来源：https://stackoverflow.com/questions/30309096/logstash-check-if-field-exists