Change Field type from keyword to integer

Elastic Stack Logstash
1

Hi There,

We use elasticsearch 5.6 with logstash,filebeat and kibana to search through the iis logs.
We have a filebeat index that already is used but the Time Taken is not a number in Kibana.
The "Time Taken property is mapped as a keyword.
We have setup in logstash a grok filter with %{NUMBER:Time-Taken but it stil is seen as a keyword..

I have changed the grok filter to %{NUMBER:Time-Taken:int but its not changing in kibana.
Do I need to restart logstash to have these changes to work?

Do you have any other ideas what i can do?

1 Like
2

I had the same problem. Filebeat data convert filed string to number on elasticsearch

3

The casting in Logstash just affects how it is represented in the JSON document sent to Elasticsearch. The mappings and index templates in Elasticsearch determines how this data is indexed and interpreted. As you can not change mappings for existing indexes, this change will only apply to new indices.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.