Field type in logstash not applied to the elastic index

Elastic Stack Logstash
1

Hi,

I have an issue with some of my field type.

In logstash I convert some fields to be in integer:

			mutate {
				add_field => {
					"api_transaction_duration" => "%{[json][transactionElement][duration]}"
					"api_transaction_bytesSent" => "%{[json][transactionElement][protocolInfo][http][bytesSent]}"
					"api_transaction_bytesReceived" => "%{[json][transactionElement][protocolInfo][http][bytesReceived]}"
					"api_transaction_remote_hostname" => "%{[json][transactionElement][protocolInfo][http][remoteName]}"
					"api_transaction_remote_address" => "%{[json][transactionElement][protocolInfo][http][remoteAddr]}"
					"api_transaction_remote_port" => "%{[json][transactionElement][protocolInfo][http][remotePort]}"
					"api_transaction_local_instance_address" => "%{[json][transactionElement][protocolInfo][http][localAddr]}"
					"api_transaction_local_port" => "%{[json][transactionElement][protocolInfo][http][localPort]}"
					tags => "transactionElement"
				}
				convert => {
					"api_transaction_duration" => "integer"
					"api_transaction_bytesSent" => "integer"
					"api_transaction_bytesReceived" => "integer"
				}
			}

In my index in kibana I have the following value:

byte%20index
byte index.PNG1376×341 16.6 KB

and as you can see field type are not editable

not%20changeable%20index%20type
not changeable index type.PNG1239×505 15.6 KB

Any ideas ?

Thanks !

Alex

2

"Decoration" (the application of common options like add_field) occurs after all the mutate functions are applied. That means the fields do not exist when convert executes. Split this into two mutate filters.

3

Ok clear and quick. thanks !

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.