Filebeat input number fields are recognized as text fields in elastic/kibana

Elastic Stack Beats
1

I am a newbee to elastic

I am not able to solve ollowing issue:
I try to load a json file with 2 number fields via filebeat in Elasticsearch. When looking into kibana discovery I see the fields with values but the values are recognized as text in stead of numbers.

I have created the next filebeat.inputs into the filebeat.yml:

- type: log
  enabled: true
  paths:
  - /var/log/test/*.json
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after
  processors:
  - decode_json_fields:
      fields: ["message"]
      target: "json"

The output goes to Elasticsearch:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

The next json file is created in the /var/log/test directory:

[
        {
                "NrOfBytes": 1670,
                "NrOfFailures": 5
        }
]

In the discovery panel of kibana the message field is loaded with the same data, which is OK:

[
        {
                "NrOfBytes": 1670,
                "NrOfFailures": 5
        }
]

But the "NrOfBytes" and "NrOfFailures" fields are loaded in text format (with a [t] in front of it in stead of a [#]):

[t] json.NrOfBytes 1670
[t] json.NrOfFailures 5

Schermafbeelding 2022-03-03 om 10.14.51

I expect a number format for those fields.
[#] json.NrOfBytes 1670
[#] json.NrOfFailures 5

Because they are not recognized as numbers I am not able to create a line graph of those json input files.

Do I have to use the Logstash module for this or does anyone have another solution for me?

Many thanks in advance.

RickB

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.