Can Logstash convert a string into a version field type?

Elastic Stack Logstash
1

I've come across Version field type | Elasticsearch Guide [8.12] | Elastic which describes exactly what I want to do with a semver text field I'm ingesting via Logstash.

However, is it possible in the Logstash filter pipeline to convert the semver string into a version field type? If so, what does the syntax look like?

I am currently letting Logstash set up the mapping for incoming logs and do not manipulate the index mapping.

When I try this under 8.12 ELK stack:

        mutate {
            add_field => { "semver_version" => "%{version}" }
            convert => { "semver_version" => "version" }
        }                              
    }

I get...

Invalid conversion type 'version', expected one of 'string,integer,float,boolean,integer_eu,float_eu'
2

I don't think so, this is elasticsearch data type, it is unrelated to logstash.

The mutate convert filter has these options, it helps you to convert some fields before sending to elasticsearch when using dynamic mapping, but in the end what matters is the mapping in elasticsearch.

If you do not have a template, the mapping is set by Elasticsearch when it receives a field for the first time, using convert in Logstash will help elasticsearch to infer the right data type for a field, but for some specific fields like this one you need to create the mapping in Elasticsearch.

You can do that using _mapping API or creating a template for your index.

3

Thanks for confirming. I had confused logstash and es having the same types.
I will generate a mapping.