JMX plugin, grok, add_field and type

[ncasaux (Nicolas)]

Hello,

I managed to set-up a successfull pipeline with Logstash and the jmx plugin.

filter {
  grok {
    match => { "metric_path" => "(?<alias>[^\.]*)\.(?<jmx_path>.*)\.(?<jmx_attribute>[^\.]*)" }
  }
}

With this, I have some fields in Elasticsearch :

  "_source": {
    "metric_path": "localhost_9010.org.apache.activemq:type=Broker,brokerName=8d9f096158ae.MemoryPercentUsage",
    "host": "localhost",
    "metric_value_number": 17,
    "type": "jmx",
    "jmx_path": "org.apache.activemq:type=Broker,brokerName=8d9f096158ae",
    "jmx_attribute": "MemoryPercentUsage",
    "@version": "1",
    "@timestamp": "2018-12-20T10:29:07.498Z",
    "path": "/usr/share/logstash/jmx",
    "alias": "localhost_9010"
  }

What I would like to achieve now is to have a field named MemoryPercentUsage.
So I added the add_field:

filter {
  grok {
    match => { "metric_path" => "(?<alias>[^\.]*)\.(?<jmx_path>.*)\.(?<jmx_attribute>[^\.]*)" }
    add_field => {
      "%{jmx_attribute}" => "%{metric_value_number}"
    }
  }
}

My issue is that the type of the field is not correct. The default field metric_value_number field is identified as an number, but not my added field MemoryPercentUsage

Is there something I'm doing wrong ?

Thanks in advance for your feedback

[ncasaux (Nicolas)]

managed to do it this way:

filter {
  grok {
    match => { "metric_path" => "(?<alias>[^\.]*)\.(?<jmx_path>.*)\.(?<jmx_attribute>[^\.]*)" }
    add_field => {
      "%{jmx_attribute}" => "%{metric_value_number}"
    }
  }
}

filter {
  mutate {
    convert => {
      "QueueSize" => "integer"
      "ConsumerCount" => "integer"
      "StoreMessageSize" => "integer"
      "MemoryUsageByteCount" => "integer"
      "StorePercentUsage" => "integer"
      "MemoryPercentUsage" => "integer"
      
    }
  }
}