Hello,
I am currently in the midst of reading a bunch of logfiles in a csv-format using logstash. Now a problem that i've come across which i've tried to solve by myself but failed, is that that when a boolean value is read, E.g. "true", when indexed into elasticsearch it is typed as a string, but what i want is to make it a boolean to be used for aggregation etc.
The catch is that i can't just use convert or mutate, as i have no idea which columns may contain these "true/false" values. So i guess i have to use something akin to the numeric_detection to figure out if the value being read is actually a boolean or not, is this even possible?
Hope someone can help me out.