# How to use logstash to change the field type of winlogbeat data

**URL:** <https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898>\
**Category:** Logstash\
**Created:** [November 30, 2018, 12:03pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898 "2018-11-30T12:03:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![godfather7](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Post date:** [November 30, 2018, 12:03pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898/1 "2018-11-30T12:03:02Z")

</div>

Hi,  
I want to change the field type from string to number of event\_data collected through winlogbeat.  
I have tried mutate way, but it's not working. Please tell me how to do it and how to reindex the data as well  
My config file is  
input {  
beats {  
port =\> 5044  
}  
}

filter {  
mutate {  
convert =\> {  
"event\_data.BootTime" =\> "integer"  
}  
}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
}

---

<div class="post-metadata">

**Author:** ![Eniqmatic](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@Eniqmatic](https://discuss.elastic.co/u/Eniqmatic)\
**Post date:** [November 30, 2018, 3:27pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898/2 "2018-11-30T15:27:11Z")

</div>

You won't be able to change the type if the index has already been created with one type. You need to re-index as you say:

[https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html)

---

<div class="post-metadata">

**Author:** ![godfather7](https://avatars.discourse-cdn.com/v4/letter/g/f07891/32.png) [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Post date:** [December 3, 2018, 9:48am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898/3 "2018-12-03T09:48:20Z")

</div>

while creating new index, i am getting this error **"Gateway Timeout "**

![Screenshot%20(49)](https://us1.discourse-cdn.com/elastic/original/3X/c/4/c441d84b04fb75fd02f10e31da85adc8e99fdede.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2018, 9:48am UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-change-the-field-type-of-winlogbeat-data/158898/4 "2018-12-31T09:48:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.