General question about field types

I have a general question about field types.
I have a field with type double. But sometimes my log line doesn't have this field and it just stays as "-" (string).
In that case Logstash refuses to index this log in ElasticSearch for obvious reasons.

What is the best practice in this case?


You can try converting it to a zero value or just not sending anything (ie drop the field), but that may cause issues with aggregations and data not being 100% representative.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.