Data tables null value - show on aggregate

[gsmith]

Hello,

I understand, So from the beginning You have a field called Standard with the count 24 but soon as you add OBJECT_SCHEMA field you lose a 20 count. This makes be believe that the fields called Standard & OBJECT_SCHEMA are not all in the same message. But I also see in my lab fields that don’t have data are not present (null value). Not sure how to tackle this issue. I would have to do some more testing into this, since I haven’t really had this type of issue. I was looking into how to put some type of data in a null field/s so it could at least be presented even if it was just a “-” sign.

EDIT: my last suggestion. Think I found a solution here.

Allow empty fields in graylog

Is it possible to configure graylog 3.0 to allow adding empty fields to the graylog index? We are storing output of tlog-rec-session to the elasticsearch using graylog (as part of normal log stream). But unfortunately this software requires “in_txt” field to be stored into the index. This field is in most cases empty (in_txt=""). It is also present in incoming raw message. But it is not shown either in graylog nor in direct elasticsearch query… Dynamic template for graylog fields should allow …

I quote from @jan

create a processing pipeline that writes a 0 into the field if no value is given would be my idea …