Thanks @ToddDtown for your reply, but not sure what else to put where.
Didn't fix my issue.
In addition your idea might lead to multiple entries of the same value, I guess.
My solution now is to restructure and use a nested field with integers.
"origin": {
"live": 1
"upload": 1
},
so in the logstash config I just need this:
mutate {
add_field => { "[origin][upload]" => 1 }
}
mutate {
convert => ["[origin][upload]","integer"]
}
where the 2nd part is "just" to ensure having a integer instead of a string.