Logstash convert string to integer

Elastic Stack Logstash
1

I have json string array that I am decomposing into separate fields, such as:
'{"eventid":1,"content":["a","b","c","d"]}'
after adding some field names and remove_field content. I get the following:
{
"@timestamp" => 2017-08-08T13:16:02.523Z,
"@version" => "1",
"eventid" => 1,
"one0" => "a",
"one1" => "b",
"one2" => "c",
"one3" => "d"
}

I removed all my indices. Started fresh and I tried to convert one1 from string to integer value in the same mutate filter that I added fields and remove_field above, except that the field still shows as string in Kibana. Not sure why it does not set the type to integer.

1 Like
2

Use mutate convert:

filter {
  mutate {
    convert => { "fieldname" => "integer" }
  }
}
1 Like
3

Yes, I did and still not working.

filter {
if [event] == 1 {
        mutate {
            add_field => {
                "one1" => "%{[content][0]}"
                "one2" => "%{[content][1]}"
                "one3" => "%{[content][2]}"
                "one4" => "%{[content][3]}"
            }
            convert      => { "one1" => "integer" }
            remove_field => [ "content", "host" ]
        }
    }
}
4

Got it. I had to place a new mutate { convert ... } after the existing mutate.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.