General question about field types

Elastic Stack Elasticsearch
1

Hi,
I have a general question about field types.
I have a field with type double. But sometimes my log line doesn't have this field and it just stays as "-" (string).
In that case Logstash refuses to index this log in ElasticSearch for obvious reasons.

What is the best practice in this case?

Thanks,

2

You can try converting it to a zero value or just not sending anything (ie drop the field), but that may cause issues with aggregations and data not being 100% representative.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.