Cannot convert type of nested field

Elastic Stack Logstash
1

Hi. I am trying to convert a field read by a json filter in logstash. I am used to convert fields from other sources, but with this nested field from a json log file, I cannot convert a quoted number string to a integer.

This is an example line of log:
{"timestamp":"2018-01-16T15:31:40.82","mensagem":"Requisição finalizada com sucesso.","source_host":"vm513-0.rede.tst","thread_id":297,"thread_name":"default task-57","logger_name":"br.jus.csjt.pje.core.infra.seguranca.PjeContextoResponseFilter","level":"INFO","class":"br.jus.csjt.pje.core.infra.seguranca.PjeContextoResponseFilter","method":"finalizarContextoRequisicao","contexto":{"requisicao.idPerfil":"30000","requisicao.siglaSistema":"PJE","requisicao.api.tipo":"GET","requisicao.tipoToken":"USUARIO","requisicao.timestamp.inicio":"2018-01-16T17:31:40.611Z","requisicao.papel":"MAGISTRADO","requisicao.api.operacao":"br.jus.csjt.pje.service.api.escaninho.EscaninhoDocumentoApi.buscarDocumentosInternos","requisicao.duracao.milissegundos":"209","requisicao.instancia":"1"}}

In the beggining of my logstash code, I apply the json filter.

json {
  source => "message"
}

All fields are created in my new index in elasticsearch. But I would like to convert the field requisicao.duracao.milissegundos to integer. I've tried it all (examples bellow).

mutate {
  convert      => [ "[contexto][requisicao][duracao][milissegundos]", "integer" ]    
  convert      => { "[contexto][requisicao][duracao][milissegundos]" => "integer" }
  convert      => [ "contexto.requisicao.duracao.milissegundos", "integer" ]
}

I've tried different syntaxes, removing old indexes and re-creating it to create new mappings in elasticsearch, but I could not read this field. It always appears as text. Any idea? I am using logstash and elasticsearch 6.x.

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.