Version:6.1.3
Operating System:win
filter {
grok{
match => [
"message","[(?[^:]]):(?[^]])]"
]
}
mutate {
#convert => ["value1", "float"]
add_field => { "%{key1}" => '%{value1}' }
convert => ["%{key}", "float"]
remove_field => "key1"
}
it can't change the %{key} tpye
when i input [aass:123456]
it out put
{
"host" => "BIH-D-6331",
"@timestamp" => 2018-03-05T06:43:15.130Z,
"value1" => "123456",
"@Version" => "1",
"message" => "[aass:123456]\r",
"aass" => "123456"
}
so if i want "aass" type is number
how can i do