-
Notifications
You must be signed in to change notification settings - Fork 16
Open
Description
rock-dashboards/ecs-configuration/logstash/conf.d/logstash-900-filter-ecs-enrich.conf
Line 27 in b99c7ae
| if [network][client][geo] { |
Check appears to always pass the check because the object is created but is empty. Logstash does not appear to handle empty object checking very well and might need to be changed to a ruby block to make this work, or possibly checking further down the object? (didn't work in my local testing).
Related elastic link for the object checking.
https://discuss.elastic.co/t/how-to-check-if-a-hash-is-empty-no-keys/93227
Metadata
Metadata
Assignees
Labels
No labels