Check whether a field exists in Logstash

if [field] is the usual Logstash conditional for a field value, but it is not a strict existence test. It evaluates to false when the field is missing, null, or the boolean value false.

Write a conditional for the value you expect

filter {
  if [user_id] and [user_id] != "" {
    mutate { add_tag => ["has_user"] }
  }

  if ![referrer] or [referrer] == "" {
    mutate { replace => { "referrer" => "direct" } }
  }

  if [request][headers][x-forwarded-for] {
    mutate { add_tag => ["forwarded_request"] }
  }
}

An empty string does not fail the first truth-value test by itself, so compare it explicitly. Zero and empty arrays also need checks appropriate to your schema; do not interpret a truthy value as proof that a field contains useful data.

Nested objects use [a][b]. [a.b] refers to a literal top-level field named a.b, which is different from a field b inside object a.

Combine conditions without hiding type errors

filter {
  if [status] and [status] >= 500 {
    mutate { add_tag => ["server_error"] }
  }
  if [level] == "ERROR" or [level] == "FATAL" {
    mutate { add_tag => ["error_level"] }
  }
  if [tags] and "urgent" in [tags] {
    mutate { add_tag => ["needs_attention"] }
  }
}

The numeric comparison assumes status is a number. Convert or validate string status codes first; an incompatible comparison can stop processing that event and log a warning.

Distinguish an absent key from a false value

When that distinction matters, inspect the event structure in a Ruby filter. For a top-level boolean field:

filter {
  ruby {
    code => 'event.set("has_enabled_key", event.to_hash.key?("enabled"))'
  }
}

This records true even when enabled contains false or null. For nested objects, inspect the parent hash and its key explicitly. Do not rely on if [field] == nil as a general Logstash null test, or assume parsing JSON null removes its key.

References

• Elastic: event dependent configuration
• Elastic: filters ruby