Change datatype for responsetimemillis field from String to Number

Elastic Stack Elasticsearch
1

Hi,

I have parsed my access logs using logstash. In my grok filter, i have given as %{NONNEGINT:responsetimemillis} in Kibana i could see that responsetimemillis is showing as string and not a number/integer. can someone help me understand why. also how can i change the datatype to Number in elasticsearch now.

Thanks,
Viswanath

2

You cannot change it without a reindex.
You need to cast it as an an int - {NONNEGINT:responsetimemillis:int} - in LS or set it via mappings

3

Hi Mark,
Can you please help me how to set it via mappings.

Thanks,
Viswanath

4

What does the mapping for the field look like now?

5

"responsetimemillis": { "type": "string", "norms": { "enabled": false }, "fielddata": { "format": "disabled" }, "fields": { "raw": { "type": "string", "index": "not_analyzed", "ignore_above": 256 } } },

6 
"responsetimemillis": {
"type": "integer",
},