Hello,
I connected Logstash to my db and it indexes certain number fields that describe a duration as dates.
I tried to just add another field-type in the created pattern with this API-call:
PUT /myindex-2020.03.10/_mapping
''{
"properties": {
"duration": {
"type": "date",
"fields": {
"raw": {
"type": "long"
}
}
}
}
}''
this worked, but the field is not being filled with anything. I - if possible at all - do not want to delete my index because it functions as the default-pattern for some visualizations I've created.
I've also tried to use the "dissect" filter-plugin:
filter {
dissect {
convert_datatype => {
"duration" => "float"
}
}
}
This resulted in a warning saying:
[org.logstash.dissect.Dissector][main] Dissector datatype conversion, value cannot be coerced, field: duration, value: 2020-03-12T00:00:00.218Z
The weird thing is that the DB-field does not contain the YYYYMMDD part .... logstash seems to add this itself.
Also when using the "mutate"-plugin the conversion works but the field is still a date. This reults in completely wrong data.
filter {
mutate {
convert => {
"duration" => "integer"
}
}
}
results in 00:00:00.0156265 being converted to Jan 19, 1970 @ 08:59:31.200
Regards