0

I would like to replace the value of field with NULL to some other value. This field is obtained by using Logstash JDBC plugin from database. Here is my config file.

input {
jdbc {
jdbc_connection_string => "url"
jdbc_user => "user"
jdbc_password => "pswd"
jdbc_driver_library => "./ifxjdbc-3-50-JC7.jar"
jdbc_driver_class => "com.informix.jdbc.IfxDriver"
statement =>  ["SELECT st1.name as s_name, st1.typ, st2.name as comp_name, zen.s_id, zen.comp_id, zen.conc_1, zen.conc_2 FROM sub_zen zen join sub st1 on st1.id = zen.s_id join sub st2 on st2.id = zen.comp_id"]}}

What I would like to do here is replace the nil value (by default typ is always nil) to P. I tried this so far.

filter{
mutate {

gsub => [

  "typ", "nil", "P"

]

}
}

Does not work.

I tried this also but it throws error

filter{
ruby {

code => "

if event.get('typ') == nil

event.set('typ') == P

end
"

}
}

Can someone help here. How I can fix this.

1
  • Could you add a sample of your data, please? Your configuration seems all right.
    – baudsp
    Aug 18, 2017 at 14:07

1 Answer 1

0

If the field is null / nil, it might be that the JDBC input is just not putting that field in your event. In which case (or even if it is you can still try the following) you can try something like this:

if !("" in [typ]) {
    mutate {
        add_field => { typ => "P" }
    }
}

See: logstash check if field exists

1
  • Thanks for your reply. It helped me in solving other issue. Here is the solution: link
    – smalhot
    Aug 23, 2017 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.