Field conversion to integer

[pmohan (Prabu Mohan)]

Hi,

I'm new to this elastic serach\logstash world !
This is one filed(extra_fields) that i'm working on at the mint
| /PublishingServices//events/: 6| /PublishingServices//sport: 1| /PublishingServices//event: 12

So the field extra_fields has valued | /PublishingServices//events/: 6| /PublishingServices//sport: 1| /PublishingServices//event: 12
kv {
source => extra_fields
field_split => "|"
recursive => "true"
trim_key => "\s"
value_split => ":"
}

and i wan the filed that's created after the value split to be integer is that possible ? I always get it as string

Please help me with few ideas !
Thanks,
Prabu

[Kryten]

I found your description of the problem quite difficult to follow.

If you have a specific field which contains a string for example "44" and you need to convert it to an integer you could use the convert function in the mutate filter as so:

if [extra_fields] {
    mutate {
        convert => { "extra_fields" => "integer" }
    }
}

[pmohan (Prabu Mohan)]

Sorry for the confusion!

After parsing a log through log stash i want to do a split on the field names "Extra_Fields" recursively and value split on ":"

I've achieved the above using KV filter below
extra_fields:"| /PublishingServices//events/: 6| /PublishingServices//sport: 1| /PublishingServices//event: 12"
kv {
source => extra_fields
field_split => "|"
recursive => "true"
trim_key => "\s"
value_split => ":"
}

All i want to do is set the Fields that created after the KV split to be integer they are set as string ;-(

if i use the dynamic numeric detection to true on mapping it works only on the first index ( i created new index per day) the index created the next day dosnt detect the dynamic mapping and changes the type to string causing field conflicts

Hope its clear now and help would be appreciated .

[pmohan (Prabu Mohan)]

Hi team,

Any advice on this issue ?

Thanks,
Prabu