topic How to exclude field with null value? in Getting Data In

How to exclude field with null value?

vin02ptl — Tue, 23 May 2023 12:26:30 GMT

I have indexed a JSON file and want to remove field which has 'null' value(event 1) but if the same field have any correct value in the next event(2) it should consider that field and extract the result. Please advise.
Logs as below:

Event1:

{
   policy: null
   protocol: null
   reason: null
   severity: low
   sid: xxx
   source_port: null
   src: xx.xx.xx.xx
   success: null
   terminal_source: xx.xx.xx.xx

 }

Event2:

{
   policy: Normal
   protocol: 4
   reason: null
   severity: low
   sid: xxx
   source_port: 234
   src: xx.xx.xx.xx
   success: null
   terminal_source: xx.xx.xx.xx

 }

Re: How to exclude field with null value

woodcock — Mon, 04 Nov 2019 16:11:45 GMT

If you are using INDEXED_EXTRACTIONS = json then you can use INGEST_EVAL like this

[YourSourcetypeHere]
INGEST_EVAL-policy   = nullif(policy,   "null")
INGEST_EVAL-protocol = nullif(protocol, "null")
INGEST_EVAL-reason   = nullif(reason,   "null")

Re: How to exclude field with null value

vin02ptl — Mon, 04 Nov 2019 18:22:01 GMT

I am looking for search time extraction for cim compliance and using kv_mode = json. In that case how to proceed?

Re: How to exclude field with null value

damode1 — Tue, 23 May 2023 05:40:15 GMT

Were you able to fix this ?