split drops empty fields

[TheVastyDeep]

logstash 8.10.1 installed via rpm on AWS.

The filter drops split fields if they are empty. If the field being split is an array of empty strings then the entire event is discarded.

input { generator { count => 1 lines => [ '{ "someField": [ "", "" ] }' ] codec => json } }
output { stdout { codec => rubydebug { metadata => false } } }
filter { split{ field => "someField" } }

produces no output. This feels wrong.

[leandrojmp]

Just came here to report this same behavior after spending a couple of hours debugging why some events where missing from a pipeline.

Tracked it down to the split filter dropping documents where the field used was an empty array.

I used a similar pipeline to replicate it:

input {
    generator {
        lines => [
            '{"fieldName": "value1", "fieldArray": []}',
            '{"fieldName": "value2", "fieldArray": ["item1", "item2"]}'
        ]
        count => 1
    }
}
filter {
    json {
        source => "message"
    }
    split {
        field => "fieldArray"
    }
}
output {
    stdout {}
}