Always fields is String type

[Beuhlet_Reseau (Newbie)]

Hello,

I have discover a problem with the help of community.

I noticed when i create new field in logstash conf fields is always detected to a string field. Take a volume,voltest,vol, fields than example

For example :

match => { "message" => "%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{NUMBER:volume}" }

or

match => { "message" => "%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{INT:voltest}" }

or

match => { "message" => "%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{NUMBER:vol}" }

mutate {
   convert => { "vol" => "integer" }
   }

Now, go see the field configuration in Kibana :

Why ?

[ppisljar (Peter Pisljar)]

once you index your first item elasticsearch will create a mapping. this mapping won't change later even if you index diff kind of data, so if your first indexed record was bad ... then its all bad.

http://localhost:9200/yourindex/_mapping/yourtype sould show you your current mappings ....

sometimes if you are just playing around its easiest to just delete the index and start again ... or you could play with mapping api.

https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html