Hi All,
I was testing the dissect processor in filebeat with this
"%{ip_address} - %{user} [%{by_date|date}] \"%{request}\" %{response_code} %{response_size} %{msg_tail}"
and I wanted to test directly to convert the field by_date to date.
When I try to start filebeat I get Invalid data type
Exiting: Failed to start crawler: starting input failed: Error while initializing input: invalid data type accessing 'filebeat.inputs.0.processors.0.dissect.tokenizer' (source:'filebeat.yml')
Just to test if the syntax, I used this %{by_date|integer}
and it worked
My question is, which are the allowed conversions?
Thank you!
Regards
Anna