Always fields is String type

Elastic Stack Kibana
1

Hello,

I have discover a problem with the help of community.

I noticed when i create new field in logstash conf fields is always detected to a string field. Take a volume,voltest,vol, fields than example

For example :

match => { "message" => "%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{NUMBER:volume}" }

or

match => { "message" => "%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{INT:voltest}" }

or

match => { "message" => "%{DATA:date}[;]%{DATA:nom_compteur}[;]%{DATA:zone}[;]%{NUMBER:vol}" }

mutate {
   convert => { "vol" => "integer" }
   }

Now, go see the field configuration in Kibana :

Why ?

2

once you index your first item elasticsearch will create a mapping. this mapping won't change later even if you index diff kind of data, so if your first indexed record was bad ... then its all bad.

http://localhost:9200/yourindex/_mapping/yourtype sould show you your current mappings ....

sometimes if you are just playing around its easiest to just delete the index and start again ... or you could play with mapping api.

https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html