# Make logstash filter map field differantly based on the value

**URL:** https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675
**Category:** Logstash
**Created:** [February 27, 2018, 2:16pm UTC](https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675 "2018-02-27T14:16:37Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![yishain11](https://avatars.discourse-cdn.com/v4/letter/y/df705f/32.png) [@yishain11](https://discuss.elastic.co/u/yishain11)
#### Post date: [February 27, 2018, 2:16pm UTC](https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675/1 "2018-02-27T14:16:38Z")

</div>

Hi everyone!  
I'm using the ELK 6 stack, and I have tranactions JSON structure like so:

```
[
{
  "fieldId": "PK_NEWJOURNAL",
  "fieldType": "NUMBER",
  "fieldValue": "1235543",
  "fieldChanged": "Y"
},
{
  "fieldId": "OFFICE",
  "fieldType": "CHAR",
  "fieldValue": "NULL",
  "fieldChanged": "Y"
},
{
  "fieldId": "UPDATE_DATE",
  "fieldType": "DATE",
  "fieldValue": "2017-12-07 05:09:54+03:000",
  "fieldChanged": "Y"
},
{
  "fieldId": "ENDDATE",
  "fieldType": "DATE",
  "fieldValue": "NULL",
  "fieldChanged": "Y"
},
{
  "fieldId": "USERNAME",
  "fieldType": "VARCHAR2",
  "fieldValue": "blah123",
  "fieldChanged": "Y"
},
....
]

```

Now, I want logstash/elasticsearch to map the "fieldValue" according to the type of "fieldType", meaning that if the fieldType in the same object is "VARCHAR2" so "fieldValue" will be saved as text, and if its "NUMBER" that it should be "number".

Can this be done?

My problem is that currently everything is saved as text, and I can't visualize anything in kibana.  
Any help will be appreaciated...

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 27, 2018, 2:33pm UTC](https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675/2 "2018-02-27T14:33:52Z")

</div>

You'll have to use different fields. An Elasticsearch field needs to be mapped either as a number **or** a string (or some other data type).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 27, 2018, 2:34pm UTC](https://discuss.elastic.co/t/make-logstash-filter-map-field-differantly-based-on-the-value/121675/3 "2018-03-27T14:34:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.