Field conversion Query


(Saket Kumar) #1

Parsed XML correctly using Logstash & output it to Elasticsearch...
now from Kibana observed the field "response.data.run.firstView.videoFrames.frame.VisuallyComplete" has data type "String"

Is there anyway to convert the data type while parsing thru logstash...

I tried couple of ways but that didnt work...

First try which failed:
xpath => [
"response/data/run/firstView/videoFrames/frame/@time", "Time_fv",
"response/data/run/firstView/videoFrames/frame/@VisuallyComplete", "Progress_fv"
]
}
mutate {convert => ["Progress_fv", "integer"]}
mutate {convert => ["Time_fv", "float"]}

Result: I don't see any destination field at Kibana.

Second try which failed:

add_field => {
"Time_fv" => "%{[response][data][run][firstView][videoFrames][frame][0][time][0]}"
Progress_fv => "%{[response][data][run][firstView][videoFrames][frame][0][VisuallyComplete][0]}"
}
mutate {convert => ["Progress_fv", "integer"]}
mutate {convert => ["Time_fv", "float"]}

Result: field gets added but with single value for both.

Requirement:
I have one Time array field and another of Progress %.
1)response.data.run.firstView.videoFrames.frame.VisuallyComplete (Progress %)
2) response.data.run.firstView.videoFrames.frame.time (Time ms)

When parsed XML i am able to search but their data type are String I need these fields to be converted to number so that i could put one at Y-Axis and another on X-Axis at Kibana.

Please help as always....i am really thankful for your valuable replies:)


(system) #2