ElasticSearch Ingest Pipeline Null Value Question

Question

If I am using an elasticsearch ingest pipeline in a Filebeat module, and I see the statement of: if: 'ctx.json?.userIdentity?.userName == null'

When json.userIdentity.userName is equal to null, what would the key/value pair look like when the if statement above would be true? {"json.userIdentity.userName":"null"}, {"json.userIdentity.userName":null}, or something else

In addition, is it fair to say that if the field doesnt exist, then the key is also equal to null?

This has been answered and is closed

Answer 1

It means that the pipeline processor will execute in any of the following conditions:

// no json key
{}

// null json key
{
   "json": null
}

// empty json key
{
   "json": {}
}

// null json.userIdentity key
{
   "json": {
      "userIdentity": null
   }
}

// empty json.userIdentity key
{
   "json": {
      "userIdentity": {}
   }
}

// null json.userIdentity.userName key
{
   "json": {
      "userIdentity": {
         "userName": null
      }
   }
}