Converting a new field

Elastic Stack Logstash
1

Hello,

In my logstash filter I created a new field with a condition which works.

if "ntf" in [entities][sdn]{
mutate{add_field=>["VNFc","ntf"]}}

Now, this VNFc field appear with a "?" in Kibana, so it can't be use for a control visualization ... I tried to put :

mutate {convert => {"VNFc" => "string"}}
}

But if the field is created after the parsing I guess it can't work.
[entities][sdn] is a string field though, but VNFc isn't.

Ty for your help :slight_smile:

2

If you do a refresh on the index pattern in Kibana does it fix that?

3

no it doesn't

I even created a new index to test

4

Ok i commented a line which was :

#mutate{split => { "[entities][sdn]"=>"/"}

and it worked, thanks for your response though