# Can logstash get the type of field?

**URL:** https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326
**Category:** Logstash
**Created:** [September 23, 2016, 3:16am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326 "2016-09-23T03:16:46Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [September 23, 2016, 3:16am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/1 "2016-09-23T03:16:46Z")

</div>

I there any way can logstash get the type of field?  
for example, "age": 1, "name":"jone'  
the age's type is integer, and the jone's type is string.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 23, 2016, 6:13am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/2 "2016-09-23T06:13:03Z")

</div>

If you explain what you want to do it'll be easier to help.

---

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [September 23, 2016, 7:42am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/3 "2016-09-23T07:42:53Z")

</div>

OK, below is the problem I met.

> [@How to save different type in one field?](https://discuss.elastic.co/t/how-to-save-different-type-in-one-field/61209):
>
> I send logs to logstash, and then output to elasticsearch. the log is json type.for example： some like this: {"time":"2015-09-22:08:11:22", request:{"url":"192.168.0.1/test","user":"xiang"}} and others maybe: {"time":"2015-09-22:08:11:22", request:{"url":"192.168.0.1/test","user":{"name":"xiang","age":20}}} In my logstash config file: filter { json { source =\> "message" } } so , after deal with the first log, the type of "user" will be string in elasticsearch, but when deal with the…

so, I want to get the type of the field. for example, there are two different type log but with same field:  
{"url":"192.168.0.1/test","user":"xiang"}}  
{"url":"192.168.0.1/test","user":{"name":"xiang","age":20}}

then I use filter{ { json { source =\> "message" } } in logstash.  
If the type of "user" is string , I save the value in field "user\_name", if not ,save the value in field "user".  
Do you have any suggest?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 23, 2016, 8:25am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/4 "2016-09-23T08:25:59Z")

</div>

Oh, okay. You need a ruby filter for this. Untested but probably works for Logstash 2.4 and later:

```nohighlight
ruby {
  code => "
    if event.include? 'user' && event.get('user').is_a? String
      event.set('user_name', event.get('user'))
      event.remove('user')
    end
  "
}

```

---

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [September 23, 2016, 8:56am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/5 "2016-09-23T08:56:14Z")

</div>

Thank you ! I will try

---

<div class="post-metadata">

### Author: ![WangXiangUSTC](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)
#### Post date: [September 26, 2016, 3:19am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/6 "2016-09-26T03:19:56Z")

</div>

there is no method "set" or "get" for LogStash::Event

I use the below code, and can run success:

```
ruby {
                code => "
                        if event.include?('user') && event['user'].is_a?(String)
                                event['user_name']=event['user']
                                event.remove('use')
                        end
                "
        }

```

thanks for your help!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 26, 2016, 5:27am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/7 "2016-09-26T05:27:07Z")

</div>

Yes, that's what you need in Logstash 2.3 and earlier.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/can-logstash-get-the-type-of-field/61326/8 "2017-07-06T04:36:59Z")

</div>


