Mutate a field depending on field type

[magnusbaeck (Magnus Bäck)]

I think you'll have to use a ruby filter. Something like this:

ruby {
  code => "
    if not event['node_post_data_json']['auth'].is_a? String
      event['node_post_data_json']['auth'] = { 'string' => event['node_post_data_json']['auth'] }
    end
  "
}