Mutate Convert not working as I expect

[lachlan.simpson]

RHEL8.3, ELK 7.12.1, I am using convert as documented, but I just can't see what I've done wrong. Here's the filter, per the docs

filter {
  if [pbs_accounting] {
    csv {
      separator => ";"
      columns   => ["date", "pbs.event_code", "pbs.job_id", "pbs.job_conf"]
      quote_char => "%"
    }
    kv {
      source => "pbs.job_conf"
      remove_field => "pbs.job_conf"
      prefix => "pbs.conf."
    }
    if [pbs.conf.Exit_status] {
      mutate {
        convert => {
          "pbs.conf.Exit_status" => "integer"
        }
      }
    }
  }
}

This is what I see in Kibana

I have re-indexed ES.

From the picture/Kibana, I see: correct field name and type, but incorrect label (t for string instead of # for integer?)

How can I solve or fix this?

[lachlan.simpson]

Actually - if the pbs.conf.Exit_status field didn't exist, would that cause a problem?

[later] Worth noting that checking it exists first doesn't fix the problem. Probably fixes other problems though.

[mangeshmj1992 (Mangesh Jadhav)]

@lachlan.simpson ,
Yes if this field does not exist than it will cause a problem.

Try to add pbs.conf.Exit_status field in csv filter under column and in your csv as well.

[lachlan.simpson]

The problem is that it doesn't exist on it's own at the csv level - it's in the pbs.job_conf ("message") field, which is why I then use kv to split them out.