Increment counter if document already exists

[yodog]

also,

How to assign a new field a certain type and value?

Perhaps surprisingly, mutate { add_field => { somefield => 1 } } doesn't actually add an integer field: $ cat test.config input { stdin { } } output { stdout { codec => rubydebug } } filter { mutate { add_field => { "somefield" => 1 } } } $ echo 'foo' | /opt/logstash/bin/logstash -f test.config Logstash startup completed { "message" => "foo", "@version" => "1", "@timestamp" => "2015-11-09T19:45:06.364Z", "host" => "hallonet", "somefield" => "1" } Logstash…