0

I would like to replace the value of field with NULL to some other value. This field is obtained by using Logstash JDBC plugin from database. Here is my config file.

input {
jdbc {
jdbc_connection_string => "url"
jdbc_user => "user"
jdbc_password => "pswd"
jdbc_driver_library => "./ifxjdbc-3-50-JC7.jar"
jdbc_driver_class => "com.informix.jdbc.IfxDriver"
statement =>  ["SELECT st1.name as s_name, st1.typ, st2.name as comp_name, zen.s_id, zen.comp_id, zen.conc_1, zen.conc_2 FROM sub_zen zen join sub st1 on st1.id = zen.s_id join sub st2 on st2.id = zen.comp_id"]}}

What I would like to do here is replace the nil value (by default typ is always nil) to P. I tried this so far.

filter{
mutate {

gsub => [

  "typ", "nil", "P"

]

}
}

Does not work.

I tried this also but it throws error

filter{
ruby {

code => "

if event.get('typ') == nil

event.set('typ') == P

end
"

}
}

Can someone help here. How I can fix this.

smalhot
  • 43
  • 1
  • 6

1 Answers1

0

If the field is null / nil, it might be that the JDBC input is just not putting that field in your event. In which case (or even if it is you can still try the following) you can try something like this:

if !("" in [typ]) {
    mutate {
        add_field => { typ => "P" }
    }
}

See: logstash check if field exists

Chris White
  • 29,949
  • 4
  • 71
  • 93
  • Thanks for your reply. It helped me in solving other issue. Here is the solution: [link](https://discuss.elastic.co/t/change-null-value-from-database-for-one-field-using-logstash-and-insert-into-elasticsearch/97552/7) – smalhot Aug 23 '17 at 10:51