Logstash 5.2 and specifying primitive types

Elastic Stack Logstash
1

I have a pipeline that uses a grok pattern to force a particular field to be an integer.

MY_PATTERN ^%{DATE_STAMP:for_date} %{INT:total_count:int}$

Logstash correctly parses my log and shoves the appropriate data into the appropriate fields with the appropriate labels; however, when I bring up my docs in Kibana the "total_count" field still registers as a string, not an int.

What am I doing wrong?

2

If you look at the actual JSON document, is total_count as integer rather than a string containing an integer? If it's an integer, have you always had :int in the pattern, i.e. do all documents in the index have total_count as an integer?

The existing mapping of a field in an index can't be changed , so chances are that total_count at some point was mapped as a string. To fix that afterwards you need to reindex.

3

Thanks Magnus!

Yes, it looks like I'll need to reindex... that, or just wait for my index to roll over.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.