0

If I am using an elasticsearch ingest pipeline in a Filebeat module, and I see the statement of: if: 'ctx.json?.userIdentity?.userName == null'

When json.userIdentity.userName is equal to null, what would the key/value pair look like when the if statement above would be true? {"json.userIdentity.userName":"null"}, {"json.userIdentity.userName":null}, or something else

In addition, is it fair to say that if the field doesnt exist, then the key is also equal to null?

This has been answered and is closed

Mike R
  • 464
  • 5
  • 16

1 Answers1

1

It means that the pipeline processor will execute in any of the following conditions:

// no json key
{}

// null json key
{
   "json": null
}

// empty json key
{
   "json": {}
}

// null json.userIdentity key
{
   "json": {
      "userIdentity": null
   }
}

// empty json.userIdentity key
{
   "json": {
      "userIdentity": {}
   }
}

// null json.userIdentity.userName key
{
   "json": {
      "userIdentity": {
         "userName": null
      }
   }
}
Val
  • 207,596
  • 13
  • 358
  • 360
  • If the root value json were not null, and not blank, then the check would be to determine if the value were equal to null, blank, or a subkey were null. Is that understanding correct? – Mike R Feb 14 '22 at 21:30
  • 1
    Basically, the condition will be true in any situation where userName doesn't have a value, doesn't exist – Val Feb 15 '22 at 04:13
  • Thank you very much! It is greatly appreciated! That makes sense – Mike R Feb 15 '22 at 12:11