Filebeat Dissect Processor

Elastic Stack Beats
1

Hi All,
I was testing the dissect processor in filebeat with this

"%{ip_address} - %{user} [%{by_date|date}] \"%{request}\" %{response_code} %{response_size} %{msg_tail}"

and I wanted to test directly to convert the field by_date to date.

When I try to start filebeat I get Invalid data type

Exiting: Failed to start crawler: starting input failed: Error while initializing input: invalid data type accessing 'filebeat.inputs.0.processors.0.dissect.tokenizer' (source:'filebeat.yml')

Just to test if the syntax, I used this %{by_date|integer}and it worked

My question is, which are the allowed conversions?

image
image856×205 4.8 KB

Thank you!
Regards
Anna

2

See the tokenizer header on Dissect strings | Filebeat Reference [7.13] | Elastic. Looks like u can use integer, long, float, double, boolean or ip.

3

Yes, thank you very much. i did not realize that the valid data types were epecified in the tokenizer header
Regards
Anna