So at the end, what I have is the tags with it value in Kibana3, all right..
The problem is that when I try to represent the numerical value of the tag "Value" it doesn't show me anything... I'm trying using a histogram in this way.. but it doesn't appear anything.
Use %{NUMBER:Value:int} instead of %{NUMBER:Value}. That field has already been mapped as a string so it might take until tomorrow's data until Kibana works as you'd expect (unless you reindex).
It seems that it is considering it as a string...
I have used : localhost:9200/_mapping for seeing it. Is that right?
"Value":{"type":"multi_field","fields":{"Value":{"type":"string","omit_norms":true},"raw":{"type":"string","index":"not_analyzed","omit_norms":true,"index_options":"docs","include_in_all":false,"ignore_above":256}}},"datetime":{"type":"multi_field","fields":{"datetime":{"type":"string","omit_norms":true},"raw":
Indexes from today have the same problem.. I've had to add a mutate sentence in the logstash configuration filter.
mutate {
convert => { "Value" => "float" }
}
but I though that only with the grok filter sentence %{NUMBER:Value:float} would be enough..
Hi @magnusbaeck, you´re showing logstash output here, but I think this is not the same as ES mapping.
Sometimes I saw the same behaviour, I think "data types" inside logstash´s pipeline are not related (almost directly) with "data types" in ES since logstash is not defining the mappings in a explicit way, am I right? ES has its own mechanisms for detecting types automatically.
Something like 2.098389 should be detected as float in ES, but this is not the case. Are you using templates? ( use this: http://localhost:9200/_template?pretty )
Indeed, if the OP is using an index template that maps the Value field as a string then that's indeed the problem, but I don't think that's the case. If the first Value field seen by ES for a given index is a float it will be mapped as a float.
Since the OP indicates that it works if a mutate filter that explicitly converts the field to a float then the problem seems to be on the Logstash side after all.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.