Cannot convert created field to integer

[aerodynamic]

Currently I'm dealing with a situation where a field name is dynamically created and needs to be set to an integer like so

mutate {
      add_field => {
         "%{fieldName}" => "%{dataInteger}"
      }
      convert => { "%{fieldName}" => "integer" }
}  

This conversion does not affect fieldName.

[Badger]

mutate does operations in a specific order, and the common options like add_field come after that. Thus [fieldName] is not created until after the convert, and convert of a non-existent field is a no-op. Split it into two mutate filters.

[aerodynamic]

Hello @Badger

Thanks for the response!

We have tried

mutate {
      add_field => {
         "%{fieldName}" => "%{dataInteger}"
      }

}
mutate {
      convert => { "%{fieldName}" => "integer" }
}

But it still doesn't function

[Badger]

I suspect what you want is

mutate { add_field => { "fieldName" => "%{dataInteger}" } }
mutate { convert => { "fieldName" => "integer" } }

[aerodynamic]

To be clear.

fieldName is the name of a variable who's value is the actual field name.

Like at some point

fieldName => "cookieCount"

Does that make sense?

[Badger]

@aerodynamic

fieldName is the name of a variable who's value is the actual field name.

That will work for the add_field because the decorator calls sprintf on the fieldname. The convert function just does a get of the field. Since it does not sprintf you cannot use %{} in the convert.

You would have to use a ruby filter to do it. The following

input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "fieldName" => "foo" "foo" => "1" } }
    ruby {
        code => '
            name = event.get("fieldName")
            event.set(name, event.get(name).to_i)
        '
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

will produce

       "foo" => 1

[aerodynamic]

Thank you for the reply and explanation!

I will try ASAP