Perhaps surprisingly, mutate { add_field => { somefield => 1 } }
doesn't actually add an integer field:
$ cat test.config
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
mutate {
add_field => { "somefield" => 1 }
}
}
$ echo 'foo' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
"message" => "foo",
"@version" => "1",
"@timestamp" => "2015-11-09T19:45:06.364Z",
"host" => "hallonet",
"somefield" => "1"
}
Logstash shutdown completed
Use a second mutate filter to convert the field.