I'm trying to add_field of integer type right after "match". But the output shows that this field is a string not integer as required. Here is the part of my filter configuration:
...
filter {
if [type] == "xferlog" {
grok {
match => { "message" => "(?\w{3}\s\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4})\s%{DATA:transfer_time}\s::ffff:%{IPV4:remote_host}\s%{NUMBER:file_size:int}\s/(?<file_name>.*)\s%{DATA:transfer_type}\s%{DATA:special_action_flag}\s_
add_field => { "numeric_field" => 1 }
}
date {
locale => "en"
match => [ "time", "EEE MMM dd HH:mm:ss YYYY" ]
target => "logTimestamp"
timezone => "UTC"
}
mutate {
remove_field => [ "path", "host" ]
add_field => { "numeric_field" => 1 }
# convert => { "numeric_field" => "integer" }
}
}
And here is the result after processing:
"message" => "**",
"@version" => "1",
"@timestamp" => "2016-02-22T08:53:28.846Z",
"type" => "xferlog",
"time" => "Tue Feb 09 00:16:14 2016",
"transfer_time" => "0",
"remote_host" => ".254",
"file_size" => 51784,
"file_name" => "******.ZIP",
"transfer_type" => "binary transfer",
"special_action_flag" => "_",
"direction" => "incoming",
"access_mode" => "real",
"user_name" => "*****",
"service_name" => "",
"authentication_method" => "0",
"completion_status" => "completed",
"numeric_field" => "1",
The 'numeric_field' is sting type but I need it to be integer. I've tried to use 'convert' but kibana shows the conflict with message mentioned on the picture below:
'
