Mapping not working as expected

Elastic Stack Elasticsearch
1

I am relatively new to Elasticsearch so I could be just misunderstanding the concept of mapping, but when I check the mapping of an index I've created, I see that the type is correctly set to "integer", but when I use Logstash to send my docs to Elasticsearch, it doesn't display as an integer. It displays with quotes around it as a string (e.g. "201").

What am I doing wrong? I thought mapping meant you tell Elasticsearch what data type the field should be and it will make sure it registers as that.

I am using the logstash-filter-useragent which is outputting the number that is not being correctly mapped as an integer.

UPDATE: Kind of figured some of it out. I was looking at the types in Kibana and the icons for the field types weren't refreshing. I realized I just needed to refresh them in the settings page. However, I'm still somewhat confused about why integer type fields are still showing up with quotation marks for me when I look at my docs in JSON format in the web browser.

2

You can use the mutate filter in Logstash to convert fields to numeric format. This will change how the values appear in the JSON document sent to Elasticsearch.

The mapping will determine how Elasticsearch parses and indexes the data. Elasticsearch will however not modify the source document. You can therefore send "201" to Elasticsearch in the JSON document and get it indexed as an integer as long as it is mapped as an integer and Elasticsearch is able to convert it.

3

That explains a lot, thanks! So I noticed I have a mapping for a field that I set the type to "date", but that causes an error in the log file that says it couldn't index the document because it was an empty string. Does that mean the document isn't even in Elasticsearch? Or it is, but that field won't be searchable?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.