jolt transformation to check if a key has null value

Question

Please help me in jolt transformation to check if a key has null value. The problem statement is mentioned as below.

For input where TimeResolved is null, severity will be as it is:

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 2,
  "TimeResolved": null
}

expected output:

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 2,
  "TimeResolved": null
}

For input where TimeResolved is not null, severity will be changed to 0:

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 2,
  "TimeResolved": 123456
}

expected output is:

{
  "parameterid": "Testing rule for event ID_Testing 1.0",
  "severity": 0,
  "TimeResolved": null
}

Answer 1

You can use isNull and notNull functions within a modify-overwrite-beta transformation such as

[
  {
    "operation": "modify-overwrite-beta",
    "spec": {
      "NullCheck": ["=isNull(@(1,TimeResolved))", 0], // if TimeResolved is NOT NULL, then zero returns  
      "severity": "=notNull(@(1,NullCheck))", // stops silently if TimeResolved is NULL
      "TimeResolved": null // set to null in any case
    }
  },
  { // get rid of the "NullCheck" attribute
    "operation": "remove",
    "spec": {
      "NullCheck": ""
    }
  }
]