Logstash配置:检查布尔字段是否存在 [英] Logstash config: check if boolean field exists

问题描述

使用Logstash 1.4.2，我在JSON文档中有一个字段myfield，它是一个布尔值.

Using Logstash 1.4.2, I have a field myfield that is a boolean value in my JSON document.

要检查它是否存在(不关心布尔值)，我用过:

To check if it exists (don't care about the boolean value) I used:

if[myfield] { ...exists... } else { ...doesn't exist... } 

测试该条件语句的结果是:

The results from testing this conditional statement are:

[myfield] does not exist   --> false
[myfield] exists, is true  --> true
[myfield] exists, is false --> false //expected true because the field exists

它正在检查布尔值，而不是其存在.

It is checking the boolean value, not its existence.

如何检查布尔值字段存在?

推荐答案

有点of脚，它开箱即用，但是您可以像这样破解它-添加布尔值的字符串表示形式，比较针对字符串，然后删除添加的字段:

Kind of lame that it doesn't work right out of the box, but you can hack it like this -- add a string representation of the boolean, compare against the string, and then remove the added field:

filter {
   mutate {
     add_field => { "test" => "%{boolean}" }
   }
   if [test] == 'true' or [test] == 'false' {
     // field is present and set right
   } else {
     // field isn't present or set to something other than true/false
   }
   mutate {
     remove_field => [ "test" ]
   }
}

这篇关于Logstash配置:检查布尔字段是否存在的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！