key_exists checks whether a named key is present in an event record. In a modify filter, it acts as a Boolean condition: the filter performs its configured operation only when the key exists. section 7.3
The same check is available in the expect filter for validating event structure. Expect treats events as effectively immutable and can warn, return the failing key, or terminate execution when validation fails. section 7.3.5
Use key_exists when you need to:
- Gate a modify operation on the presence of an attribute. section 7.3
- Check that required event data survives parsing or enrichment. section 6.8.2 section 7.3.5
- Detect application changes that produce unexpectedly shaped log events. section 7.3.5
Protecting ingestion from incomplete records
After a malformed JSON record prevents complete ingestion, use a conditional modify operation to act only when a required key exists, or use expect to flag records whose structure is incomplete. In production, give the failure result_key a unique name and preferably an error code so the issue can be traced. section 6.8.2 section 7.3.5
