Filter conditions when field is present or not present.

[gwsales]

Need added filter conditions to filter on events that do or do not have specific fields present in the events.

Logstash Example to be ported to winlogbeats:

if ![field] {
drop {}
}
or
if [field]{
drop {}
}

Current workaround is to do a regex with .* or a not regex .*.

[exekias]

I'm 👍 to this feature, having a condition to check if a field (or list of fields) exist would be very useful

[videetssinghai]

Hey If anyone isn't working on this, can I take this up?
Please provide some guidance to start

[exekias]

Awesome @videetssinghai 🎉, as far as I know, no one is working on this, so feel free to give it a try! Here you have some useful pointers:

1. Docs on existing conditions: https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#conditions
2. Implementation of current conditions: https://github.com/elastic/beats/blob/master/libbeat/processors/condition.go

[andrewvc]

Closing, was fixed in #6653