From f5937d841b9268ccbcbef8ed74f2557dfca7f90f Mon Sep 17 00:00:00 2001 From: Karen Metts Date: Fri, 3 Oct 2025 18:28:44 -0400 Subject: [PATCH] Doc: Update docs for testing for boolean fields --- docs/reference/tips-best-practices.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/reference/tips-best-practices.md b/docs/reference/tips-best-practices.md index f6003263f5d..2d2eed478d9 100644 --- a/docs/reference/tips-best-practices.md +++ b/docs/reference/tips-best-practices.md @@ -60,13 +60,15 @@ filter { # we use a "temporal" field with a predefined arbitrary known value that # lives only in filtering stage. add_field => { "[@metadata][test_field_check]" => "a null value" } + } +filter { + mutate { # we copy the field of interest into that temporal field. # If the field doesn't exist, copy is not executed. copy => { "test_field" => "[@metadata][test_field_check]" } } - # now we now if testField didn't exists, our field will have # the initial arbitrary value if [@metadata][test_field_check] == "a null value" {