NGINX log filter $upstream_response_time JSON ELK "-" parsefailure NGINX log filter $upstream_response_time JSON ELK "-" parsefailure json json

NGINX log filter $upstream_response_time JSON ELK "-" parsefailure


Try this:

map $upstream_response_time $temprt {  default $upstream_response_time;  ""      0;}

$upstream_response_time either a number or unset. Nginx logs unset variables as dash (-), but map treats them as empty strings.


A fleshed out example from @AlexeyTen using null instead of 0 to differentiate from real values since I wasn't 100% sure how to use mapped variables:

map $upstream_response_time $temprt {  default $upstream_response_time;  ""      null;}log_format le_json '{ "@timestamp": "$time_iso8601", '               '"remote_addr": "$remote_addr", '               '"remote_user": "$remote_user", '               '"body_bytes_sent": "$body_bytes_sent", '               '"status": $status, '               '"request": "$request", '               '"request_method": "$request_method", '               '"response_time": $temprt, '               '"http_referrer": "$http_referer", '               '"http_user_agent": "$http_user_agent" }';