Change field type of index-pattern from date to number

Elastic Stack Logstash
1

Hello,

I connected Logstash to my db and it indexes certain number fields that describe a duration as dates.

I tried to just add another field-type in the created pattern with this API-call:

PUT /myindex-2020.03.10/_mapping
''{
"properties": {
"duration": {
"type": "date",
"fields": {
"raw": {
"type": "long"
}
}
}
}
}''

this worked, but the field is not being filled with anything. I - if possible at all - do not want to delete my index because it functions as the default-pattern for some visualizations I've created.

I've also tried to use the "dissect" filter-plugin:

filter {
dissect {
convert_datatype => {
"duration" => "float"
}
}
}

This resulted in a warning saying:

[org.logstash.dissect.Dissector][main] Dissector datatype conversion, value cannot be coerced, field: duration, value: 2020-03-12T00:00:00.218Z

The weird thing is that the DB-field does not contain the YYYYMMDD part .... logstash seems to add this itself.

Also when using the "mutate"-plugin the conversion works but the field is still a date. This reults in completely wrong data.

filter {
mutate {
convert => {
"duration" => "integer"
}
}
}

results in 00:00:00.0156265 being converted to Jan 19, 1970 @ 08:59:31.200

Regards

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.