Field conversion

Elastic Stack Logstash
1

I'm trying to convert from strings to floats, in logstash, and push this to elasticsearch, I've deleted the index, however once it's created the field is still of type string.

This is the field I'm splitting, and converting:

nagios.results	       	load average: 6.61, 7.86, 9.57

This is the part of the config doing split and conversion:

if [nagios][service] == "CPU Load" {
  mutate {
     split => { "[nagios]results" => " " }
     add_field => [ "load", "%{[nagios]results[2]}" ]
  }

  mutate {
     convert => { "load" => "float" }
  }
}

I've deleted the index, and the index pattern, however when the index is recreated, the load is still of type string. In this instance it would be:

load       6.61

Is there a step I'm missing?

2

Not sure why it hadn't updated the index, however it's now working properly.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.