ELK - Unable to see datatype conversion in Kibana

Hello team,

I am facing one strange issue with ELK v5.6 where I can see that out of 6 integer fields, 4 fields datatype got converted to number successfully whereas 2 fields are still showing datatype as string. I tried several times to re-create indices and did testing, but still same issue persist, even sometimes I noticed which fields got converted successfully earlier for one index, but failed to convert successfully for new index. In Kibana template, all of the 6 fields datatype is reflected as "long" as per the mapping file. I have no clue what's wrong here. It would be really helpful if someone please help to fix it ASAP. Appreciate your quick help here.

Please let me know if there is any way to verify if datatype conversion & mapping has been done successfully at logstash end instead of checking it in Kibana Template.

Here are these 2 fields where datatype conversion to number has NOT done due to some reason.

Sample log file

Logstash conf file

bb-poc.json file (where field datatype is specified)

Kibana Template

Record in Kibana (where datatype conversion done successfully for 4 fields)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.