title: Inserting a dummy value for empty field while parsing using grok logstash
body: <p>i am trying to parse logs and put it inside elastic search using logstash.</p>
  
  <p>my log file is on the below format</p>
  
  <pre><code>[18-Aug-2016 02:28:46,537][ERROR][thread1][package.name] there is error in line 52
  
  \[%{GREEDYDATA:date} %{GREEDYDATA:time}\]\[%{LOGLEVEL:log_type}\]\[%{GREEDYDATA:thread_name}\]\[%{GREEDYDATA:package}\](%{GREEDYDATA:log_msg})?
  </code></pre>
  
  <p>when i run this grok filter i get the output properly. However ,  there are instances where i get the input without last field (log_msg). something like this:</p>
  
  <pre><code>[18-Aug-2016 02:28:46,537][ERROR][thread1][package.name]
  </code></pre>
  
  <p>In this case grok is ignoring the last field log_msg and that is not getting inseted into elastic search.</p>
  
  <p>But, is there any way , we can set an empty string or string saying "no data" for log_msg field if that doesn't exist in the message.</p>
  
  <p>Real Ouput:</p>
  
  <pre><code>{
          "message" =&gt; "[18-Aug-2016 02:28:46,537][ERROR][thread1][package.name]",
         "@version" =&gt; "1",
       "@timestamp" =&gt; "2016-08-17T12:31:58.209Z",
             "path" =&gt; "/home/admin-nfv/test1_log.log",
             "host" =&gt; "nendc1-bg-d104",
             "date" =&gt; "18-Aug-2016",
             "time" =&gt; "02:28:46,537",
         "log_type" =&gt; "ERROR",
      "thread_name" =&gt; "thread1",
          "package" =&gt; "package.name"
  }
  </code></pre>
  
  <p>Expected Output:</p>
  
  <pre><code>{
          "message" =&gt; "[18-Aug-2016 02:28:46,537][ERROR][thread1][package.name]",
         "@version" =&gt; "1",
       "@timestamp" =&gt; "2016-08-17T12:31:58.209Z",
             "path" =&gt; "/home/admin-nfv/test1_log.log",
             "host" =&gt; "nendc1-bg-d104",
             "date" =&gt; "18-Aug-2016",
             "time" =&gt; "02:28:46,537",
         "log_type" =&gt; "ERROR",
      "thread_name" =&gt; "thread1",
          "package" =&gt; "package.name",
          "log_msg" =&gt; "no data"
  }
  </code></pre>