Logstash filter that drops events when something is null

Question

So I wrote a filter to drop any event that has a certain field with a value of null:

 filter {
    if[type] == "flow" and [packet_source][ip] == "" {
            drop { }
    }
}

However, this does not work. Does anyone have any idea why? The names of the parameters are correct

Logstash version 5.2

This answer might help: http://stackoverflow.com/a/28959437/4604579 — Val, Mar 01 '17 at 05:52

score 4 · Accepted Answer · answered Mar 01 '17 at 06:43

Your filter is checking that [packet_source][ip] == "" exists and is not null.

Not sure what [type] == "flow" is, but I think you want

filter {
  if[type] == "flow" and ("" not in [packet_source][ip]) {
    drop { }
  }
}

You can also use !("" in [packet_source][ip]) or !([packet_source][ip] == "")

However, per the documentation, there’s currently no way to differentiate between a field that doesn’t exist versus a field that’s simply false.

Thank you! I got confused by a couple other forum posts that I saw, but what you said there works. `[type] == "flow" ` Is netflow data collected by [Packetbeat](https://www.elastic.co/products/beats/packetbeat) — BenjaFriend, Mar 01 '17 at 15:54

score 1 · Answer 2 · answered Mar 01 '17 at 11:11

Adding to @cattastrophe's answer, try this as well:

if "flow" in [type] and "" in [packet_source][ip]{      
    drop { }        
}

AND

if[type] == "flow" and [packet_source][ip] == 'null'{ <-- please try with double quotes around null as well
        drop { }        
}

2 Answers2