Default value for tag if field does not exist

[bmgante]

Hi All, i have the following transformation sector to apply a filter on idr json input and then create a metric to count the errors.
The point is that for some json events, some tags do not exist and vector creates the metric anyway only with the existing tags.
Is there any approach to set a default value for a tag if it does not exist in the json ("", or "N/A", etc). I do not want to filter those json events on filter with exists(.field) beucase they can be "valid" events.

    filter_idr_trunk_errors:
      type: filter
      inputs:
        - idr
      condition: >-
        .service == "idr" && .call.type == "trunk" && to_int!(.sip.status.code) >=
        500
    idr_metrics_trunk_errors:
      type: log_to_metric
      inputs:
        - filter_idr_trunk_errors
      metrics:
        - field: .call.direction
          name: idr_trunk_errors
          type: counter
          tags:
            direction: "{{`{{.call.direction}}`}}"
            domain: "{{`{{.call.domain.name}}`}}"
            trunk: "{{`{{.call.trunk.name}}`}}"
            cluster: "{{`{{cluster}}`}}"
            sip_status_name: "{{`{{.sip.status.name}}`}}"
            transport: "{{`{{.sip.transport}}`}}"
            codec: "{{`{{.sdp.codec}}`}}"

[bmgante]

Wondering if this works...
codec: "{{{{.sdp.codec | default('unknown')}}}}"

[jszwedko]

It doesn't yet, but we have thought about adding something like that. See #1692

As a workaround you can use a remap transform to default the field if it is unset like: if !exists(.sdp.codec) { .sdp.codec = "unknown" }

[bmgante]

Ok, will try that. Should the remap transform feed the filter or the log to metric?

[jszwedko]

Either way seems like it should work.

[bmgante]

Having some syntax issues... Would you mind to help create that yaml remap section? The goal was to perform that remap globally for input idr and for all these fields being used as tags. The output of that remap would then feed the filter and log to metric sections.
Thanks a lot

[jszwedko]

🤔 Could you provide the config you are trying and the errors you are seeing?