diff --git a/docs/reference/tips-best-practices.md b/docs/reference/tips-best-practices.md index f6003263f5d..2d2eed478d9 100644 --- a/docs/reference/tips-best-practices.md +++ b/docs/reference/tips-best-practices.md @@ -60,13 +60,15 @@ filter { # we use a "temporal" field with a predefined arbitrary known value that # lives only in filtering stage. add_field => { "[@metadata][test_field_check]" => "a null value" } + } +filter { + mutate { # we copy the field of interest into that temporal field. # If the field doesn't exist, copy is not executed. copy => { "test_field" => "[@metadata][test_field_check]" } } - # now we now if testField didn't exists, our field will have # the initial arbitrary value if [@metadata][test_field_check] == "a null value" {