We are using a custom log capture format (JSON) and have quite a few captures in place.
What’s the easiest and most performant way to output a blank string instead of the capture string if it wasn’t set?
Specifically, we have a custom log format with this in it:
"user-agent" :"%[capture.req.hdr(0),json(utf8s)]",
"referer" :"%[capture.req.hdr(1),json(utf8s)]",
"api-key" :"%[capture.req.hdr(2),json(utf8s)]",
but if the respective headers weren’t set we get a dash -
as the capture output.
I’d rather see just a blank field. What’s the easiest way to rewrite these captures to get a blank value instead?