Logstash 5.2 and specifying primitive types

I have a pipeline that uses a grok pattern to force a particular field to be an integer.

MY_PATTERN ^%{DATE_STAMP:for_date} %{INT:total_count:int}$

Logstash correctly parses my log and shoves the appropriate data into the appropriate fields with the appropriate labels; however, when I bring up my docs in Kibana the "total_count" field still registers as a string, not an int.

What am I doing wrong?

If you look at the actual JSON document, is total_count as integer rather than a string containing an integer? If it's an integer, have you always had :int in the pattern, i.e. do all documents in the index have total_count as an integer?

The existing mapping of a field in an index can't be changed , so chances are that total_count at some point was mapped as a string. To fix that afterwards you need to reindex.

Thanks Magnus!

Yes, it looks like I'll need to reindex... that, or just wait for my index to roll over.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.