Conversion not working

Elastic Stack Logstash
1

Hello, conversion type in logstash doesn't work.
Can you help me please.

I want to see in Kibana the data of me .csv file.

This is what there is in my file (toto.csv) :

2|fichier_2
3|fichier_3

There is :

<integer>|<string>

This is my logstash config file (conf) :

# This is a comment. You should use comments to describe
# parts of your configuration.
input {
  file {
    path => "/tmp/toto.csv"
    sincedb_path => '/opt/Mediacom/Confs/ELK/sincedbfile-test'
    start_position  => "beginning"
    type => "syslog"
  }
}
    
filter {
  csv {
    columns => [ 'En_version', 'En_fsource' ]
    separator => '|'
    convert => { "En_version" => "integer" }
  }

  mutate {
    convert => { "En_version" => "integer" }
  }
}
output {
  elasticsearch {
    index => 'mediacom_idx_toto'
    hosts => ["192.168.149.235:9200"]
  }
}

I start elasticserach
I start logstash like that : logstash -f conf

The problem is that in Kibana, all my data are in string (with 't' on the left), first column 'En_version' is not in integer (with '#' on the left) like I configured it in my logstash file :

|t  En_fsource|       |fichier_4|
|t  En_version|       |4|

Can you help me please to make first column in integer, not in string ?
Thank you for advance.

2

Did you refresh the field list in Kibana or use ES's get mapping API to make sure that the field really is a string?

The mapping of a field can't be changed for a given index. Perhaps you created the index when En_version was a string so that the field was mapped as a string. If so, reindex or delete the index if you're just trying things out.

1 Like
3

Thank you magnusbaeck.
The solution was to refresh field list, I discovered that yesterday and it solved my problem.
For those who have this problem and don't want to delete old index with wrong data type conversion, you can select index with good data type conversion in Kibana (management), so you have good data type without conflict with other index.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.