# Convert mapping in the table logstash

**URL:** <https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753>\
**Category:** Logstash\
**Created:** [May 11, 2021, 10:43pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753 "2021-05-11T22:43:36Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [May 11, 2021, 10:43pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/1 "2021-05-11T22:43:36Z")

</div>

good, I need help with the mapping in logstash, I need to change certain metrics to integer, but the metrics go together in a table so it does not let me change them. I attach the configuration in logstash.

```auto
input {
  http_poller {
    urls => {
      kvh => "https://Default_Generated_Alteon_BBI_Cert:443/config/SlbStatLinkpfRServerTable"
     }
# cacert => "/path/downloaded_cert.pem"
    truststore => "/path/downloaded_truststore.jks"
    user => "user"
    password => "secret"
    truststore_password => "secret"
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
# ssl => true
 # ssl_certificate_verification => true
  }
}

output {
   stdout { codec => rubydebug }
 elasticsearch {
    hosts => ["https://425d6971696czcbfb23f3ef706bd675a.us-central1.gcp.cloud.es.io:9243"]
    user => "elastic"
    password => "secret"
    index => "radwareefecty"
   }

}

```

As you can see in the image the metrics that give number are in string, but all these metrics are in a matrix (table), I need to change them to integer, but with the filter does not let me so they are in a table and not individual.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/4/8404f91a39b6b30084eedb2281dcf745ac1a1970.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 11, 2021, 10:57pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/2 "2021-05-11T22:57:24Z")

</div>

Can you show us the JSON tab instead of the Table tab please, and just copy the text, do not post a screenshot.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [May 11, 2021, 11:14pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/3 "2021-05-11T23:14:19Z")

</div>

of course, of course, look

```auto
{
  "_index": "radwareefecty",
  "_type": "_doc",
  "_id": "mH0rXXkBQzzVpIqvCzkb",
  "_version": 1,
  "_score": null,
  "_source": {
    "SlbStatLinkpfRServerTable": [
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "N/A",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Claro-Internet4",
        "IpAddr": "190.145.144.65",
        "TotBwPeak": "0.0",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "0.0",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "0.0",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "N/A",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "N/A",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Columbus-Internet5",
        "IpAddr": "190.242.127.16",
        "TotBwPeak": "0.0",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "0.0",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "0.0",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "N/A",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "02:28:52 Sat May 1, 2021",
        "DnBwPeak": "0.1",
        "UpBwPeak": "1.4",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Internet_Navegacion-Claro_1",
        "IpAddr": "190.143.70.35",
        "TotBwPeak": "1.5",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "1620.9",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "1617.9",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "01:53:29 Sat May 1, 2021",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "02:28:52 Sat May 1, 2021",
        "DnBwTot": "3.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "01:52:18 Sat May 1, 2021",
        "DnBwPeak": "0.3",
        "UpBwPeak": "5.4",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Internet_Navegacion-Claro_2",
        "IpAddr": "190.144.221.225",
        "TotBwPeak": "5.8",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "130.9",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "125.7",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "01:52:18 Sat May 1, 2021",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "01:52:18 Sat May 1, 2021",
        "DnBwTot": "5.3"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "19:53:13 Wed Apr 14, 2021",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "Internet_Navegacion-UNE_1",
        "IpAddr": "200.122.229.81",
        "TotBwPeak": "0.1",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "1.0",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "0.9",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "19:53:13 Wed Apr 14, 2021",
        "State": 2,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "19:53:13 Wed Apr 14, 2021",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "01:53:34 Sat May 1, 2021",
        "DnBwPeak": "0.0",
        "UpBwPeak": "55.0",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "L2L_Claro",
        "IpAddr": "10.10.105.16",
        "TotBwPeak": "55.0",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "55.6",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "55.6",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 1,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "01:53:34 Sat May 1, 2021",
        "DnBwTot": "0.0"
      },
      {
        "DwBwUSage": "--",
        "TotBwPeakTmSt": "01:52:38 Sat May 1, 2021",
        "DnBwPeak": "0.0",
        "UpBwPeak": "0.8",
        "UpBwUsage": "--",
        "LastTranfetTmSt": "N/A",
        "DwBwCurr": "0.0",
        "Index": "L2L_CyW",
        "IpAddr": "10.10.100.16",
        "TotBwPeak": "0.8",
        "TotBwPeakPer": "--",
        "UpDnBwTot": "3.8",
        "UpBwPeakPer": "--",
        "TotCurrUsage": "--",
        "UpBwTot": "3.8",
        "CurrSess": 0,
        "UpBwCurr": "0.0",
        "DnBwPeakPer": "--",
        "DnBwPeakTmSt": "N/A",
        "State": 1,
        "TotCurrbw": "0.0",
        "UpBwPeakTmSt": "01:52:38 Sat May 1, 2021",
        "DnBwTot": "0.0"
      }
    ],
    "@timestamp": "2021-05-11T20:41:00.284Z",
    "@version": "1"
  },
  "fields": {
    "@timestamp": [
      "2021-05-11T20:41:00.284Z"
    ]
  },
  "sort": [
    1620765660284
  ]
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [May 11, 2021, 11:15pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/4 "2021-05-11T23:15:35Z")

</div>

the number value is in string (" ")

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 11, 2021, 11:35pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/5 "2021-05-11T23:35:43Z")

</div>

OK, so it is an array of hashes... you could do

```
    ruby {
        code => '
            def is_number? string
                true if Float(string) rescue false
            end

            t = event.get("SlbStatLinkpfRServerTable")
            if t
                newT = []
                t.each { |x|
                    newX = {}
                    x.each { |k, v|
                        if is_number? v
                            v = v.to_f
                        end
                        newX[k] = v
                    }
                    newT << newX
                }
                t = event.set("SlbStatLinkpfRServerTable", newT)
            end
        '
    }

```

that will convert anything that is a valid string representation of a float (that includes integers) to a float. If you want integers to be integers you will have to have a second helper function similar to is\_number? to check is\_integer? and add an else branch to the if.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [May 11, 2021, 11:42pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/6 "2021-05-11T23:42:08Z")

</div>

ok but how would it go in the input?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 11, 2021, 11:44pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/7 "2021-05-11T23:44:47Z")

</div>

You would wrap it in

```
filter {
}

```

Filters are not inputs or outputs.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [May 11, 2021, 11:50pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/8 "2021-05-11T23:50:12Z")

</div>

ok very thanks, I've learned , thanks you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2021, 11:50pm UTC](https://discuss.elastic.co/t/convert-mapping-in-the-table-logstash/272753/9 "2021-06-08T23:50:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.