Field type in logstash not applied to the elastic index


I have an issue with some of my field type.

In logstash I convert some fields to be in integer:

			mutate {
				add_field => {
					"api_transaction_duration" => "%{[json][transactionElement][duration]}"
					"api_transaction_bytesSent" => "%{[json][transactionElement][protocolInfo][http][bytesSent]}"
					"api_transaction_bytesReceived" => "%{[json][transactionElement][protocolInfo][http][bytesReceived]}"
					"api_transaction_remote_hostname" => "%{[json][transactionElement][protocolInfo][http][remoteName]}"
					"api_transaction_remote_address" => "%{[json][transactionElement][protocolInfo][http][remoteAddr]}"
					"api_transaction_remote_port" => "%{[json][transactionElement][protocolInfo][http][remotePort]}"
					"api_transaction_local_instance_address" => "%{[json][transactionElement][protocolInfo][http][localAddr]}"
					"api_transaction_local_port" => "%{[json][transactionElement][protocolInfo][http][localPort]}"
					tags => "transactionElement"
				convert => {
					"api_transaction_duration" => "integer"
					"api_transaction_bytesSent" => "integer"
					"api_transaction_bytesReceived" => "integer"

In my index in kibana I have the following value:

and as you can see field type are not editable

Any ideas ?

Thanks !


"Decoration" (the application of common options like add_field) occurs after all the mutate functions are applied. That means the fields do not exist when convert executes. Split this into two mutate filters.

Ok clear and quick. thanks !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.