How can convert field to int, float

(Cmorell) #1


I'm starting to use ELK, but I have a problem to convert fields... always, all the fields types are string.

Here an example of log line:

2016-05-10 19:44:37 123 12 199

and here logstash config file:

input { file { type => "platform" path => "/home/vagrant/platform.log" start_position => beginning } } filter { if [type]=="platform" { grok { match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} %{NUMBER:id:int} %{NUMBER:platform_type:int} %{NUMBER:value:int}"] } mutate { convert => { "value" => "integer" "platform_type" => "integer" "id" => "integer" } } } } output { elasticsearch { hosts => ["localhost:9200"] index => "platform-%{+YYYY-MM-dd}" } }

and when I test it, using

curl -XGET 'http://localhost:9200/platfrom-*'



All fields are strings...

I don't know what I am doing bad, can anyone help me?


(Mark Walkom) #2

Ideally, you should be setting this in ES as well via a mapping or a template.

(Fabien Baligand) #3

To me, your logstash configuration is nice.
And normally, you have not to add "mutate" filter, since in grok filter, you already convert fields to int using :int.

To be sure that your conversion is correct, you can add this output :

output {
  stdout { codec => rubydebug }

If it is correct, you see id => 1
If it is not correct, you see id => "1"

That said, you have to know that elasticsearch index defines its mapping using first document.
So I invite you to :

  • drop index, put a document using logstash, and verify that new index has good mapping
  • check that there is nothing elsewhere (in your logstash pipeline or elsewhere) that create documents with int fields as a string.

(krishna ravula) #4

its not working for me too i used both types of config (i.e) {number:num:int} and mutate any suggestions or ideas .pls..

(Fabien Baligand) #5

Did you try the following output configuration to check that Logstash does the conversion right ?
Because maybe your problem is not Logstash conversion but elasticsearch mapping.

(Mark Walkom) #6

Please start your own thread, this one is super old.

(krishna ravula) #7

how to do that? im new to it can you help me??

(Fabien Baligand) #8

(system) #9