How to convert a json field to string

Elastic Stack Logstash
1

my log (json) content is：
{"release_time": "1998-01-01", "home_url": "http://www.777.com/show_page/id_001.html", "isVip": "", "channel": "777"}
{"release_time": "2009", "home_url": "http://www.666.com/show_page/id_002.html", "isVip": true, "channel": "666"}
{"release_time": "", "home_url": "http://www.666.com/show_page/id_003.html", "isVip": "", "channel": "666"}

logstash config :
input{}
filter{
json{
source => "message"
}
mutate {
convert => { "[release_time]" => "string" }
convert => { "[isVip]" => "string" }
}
}
output {
elasticsearch {index => "test-%{+YYYY.MM.dd}"}
}

then logstash error logs is:
"reason"=>"failed to parse [release_time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"\""

curl -XGET http://localhost:9200/test-2016.05.12
...
"release_time":{"type":"date","format":"strict_date_optional_time||epoch_millis"}

2

Hi, the right configuration is :

mutate {
                convert => { "release_time" => "string" }
                convert => { "isVip" => "string" }
}

But given your initial log, you don't need conversion.
In logstash, it is a string.

Your problem is in elasticsearch : when mapping is not defined, by default, elasticsearch tries to automatically define the type. If elasticsearch detects a date format, then it converts the field to date and mapping is date.

So if you really want string into elasticsearch, you have to explicitly define elasticsearch mapping for this field.

I advice you to define a elasticsearch template in elasticsearch logstash output :
https://www.elastic.co/guide/en/logstash/2.3/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template

3

thanks