drop if empty field
Armaggedon
I have a file with multiple log lines, but I'm only interested in one type that has 6 fields in CSV format. I want to discard all the rest. So I have this [partial] file:
```
Module xm_csv
Fields $time, $date, $host, $from, $ip, $loginfo, $color
FieldTypes string, string, string, string, string, string, integer
Delimiter |
Module im_file
File "C:\\M2PLogs\\log*"
SavePos TRUE
if $raw_event =~ /^#/ drop();
else
{
csv->parse_csv();
if ( not defined $color ) drop();
$message = $raw_event;
$raw_event = to_json();
}
```
In this case, if the line doesn't have 6 fields, I understand the `$color` field will be undefined. But it doesn't work, I get both lines in output: the correct one being processed and the rest in plain text.
Perhaps I'm following the wrong approach, so I'm also open for alternatives. Could you please help?
