# How to change field type of filebeat modules?

**URL:** <https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 13, 2021, 5:34am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966 "2021-04-13T05:34:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![new2\_elk](https://avatars.discourse-cdn.com/v4/letter/n/54ee81/32.png) [@new2\_elk](https://discuss.elastic.co/u/new2_elk)\
**Post date:** [April 13, 2021, 5:34am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966/1 "2021-04-13T05:34:12Z")

</div>

Hi guys,

I am using the panw module on filebeat to pass log to logstash then pass to Elasticsearch.

Then I added 1 more extract field in the "/usr/share/filebeat/module/panw/panos/config/input.yml" but the default type appeared on Elasticsearch is string and I would like to change it to Integer. May I know where to change this setting?.

---

<div class="post-metadata">

**Author:** ![deeshu](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@deeshu](https://discuss.elastic.co/u/deeshu)\
**Post date:** [April 13, 2021, 8:46am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966/2 "2021-04-13T08:46:54Z")

</div>

I hope adding like below at the end of input.yml under '-convert' operation can solve the problem. otherwise you can change the data type from index template in elasticsearch or using custom pipeline in logstash.

- {from: oldfield, to: newfield, type: long}

---

<div class="post-metadata">

**Author:** ![new2\_elk](https://avatars.discourse-cdn.com/v4/letter/n/54ee81/32.png) [@new2\_elk](https://discuss.elastic.co/u/new2_elk)\
**Post date:** [April 13, 2021, 9:17am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966/3 "2021-04-13T09:17:17Z")

</div>

I tried to add this at the end {from: ABC, to: ABC, type: integer}, but the type is still text....  
BTW may I know by changing the index template, will also update those indexed data? or only affect the future incoming data?

---

<div class="post-metadata">

**Author:** ![deeshu](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@deeshu](https://discuss.elastic.co/u/deeshu)\
**Post date:** [April 13, 2021, 9:32am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966/4 "2021-04-13T09:32:14Z")

</div>

Ok. To update the old logs you've to re-index the document which is a slow process for large set of documents.

---

<div class="post-metadata">

**Author:** ![new2\_elk](https://avatars.discourse-cdn.com/v4/letter/n/54ee81/32.png) [@new2\_elk](https://discuss.elastic.co/u/new2_elk)\
**Post date:** [April 13, 2021, 9:33am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966/5 "2021-04-13T09:33:57Z")

</div>

May I know what is the location that define the field type for filebeat modules? The convert comamnd seems not working..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2021, 11:34am UTC](https://discuss.elastic.co/t/how-to-change-field-type-of-filebeat-modules/269966/6 "2021-05-11T11:34:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.