Filebeat input number fields are recognized as text fields in elastic/kibana

I am a newbee to elastic

I am not able to solve ollowing issue:
I try to load a json file with 2 number fields via filebeat in Elasticsearch. When looking into kibana discovery I see the fields with values but the values are recognized as text in stead of numbers.

I have created the next filebeat.inputs into the filebeat.yml:

- type: log
  enabled: true
  paths:
  - /var/log/test/*.json
  multiline.pattern: '^{'
  multiline.negate: true
  multiline.match: after
  processors:
  - decode_json_fields:
      fields: ["message"]
      target: "json"

The output goes to Elasticsearch:

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

The next json file is created in the /var/log/test directory:

[
        {
                "NrOfBytes": 1670,
                "NrOfFailures": 5
        }
]

In the discovery panel of kibana the message field is loaded with the same data, which is OK:

[
        {
                "NrOfBytes": 1670,
                "NrOfFailures": 5
        }
]

But the "NrOfBytes" and "NrOfFailures" fields are loaded in text format (with a [t] in front of it in stead of a [#]):

[t] json.NrOfBytes 1670
[t] json.NrOfFailures 5

Schermafbeelding 2022-03-03 om 10.14.51

I expect a number format for those fields.
[#] json.NrOfBytes 1670
[#] json.NrOfFailures 5

Because they are not recognized as numbers I am not able to create a line graph of those json input files.

Do I have to use the Logstash module for this or does anyone have another solution for me?

Many thanks in advance.

RickB

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.