Mutate Convert not working as I expect

RHEL8.3, ELK 7.12.1, I am using convert as documented, but I just can't see what I've done wrong. Here's the filter, per the docs

filter {
  if [pbs_accounting] {
    csv {
      separator => ";"
      columns   => ["date", "pbs.event_code", "pbs.job_id", "pbs.job_conf"]
      quote_char => "%"
    kv {
      source => "pbs.job_conf"
      remove_field => "pbs.job_conf"
      prefix => "pbs.conf."
    if [pbs.conf.Exit_status] {
      mutate {
        convert => {
          "pbs.conf.Exit_status" => "integer"

This is what I see in Kibana

I have re-indexed ES.

From the picture/Kibana, I see: correct field name and type, but incorrect label (t for string instead of # for integer?)

How can I solve or fix this?

Actually - if the pbs.conf.Exit_status field didn't exist, would that cause a problem?

[later] Worth noting that checking it exists first doesn't fix the problem. Probably fixes other problems though.

@lachlan.simpson ,
Yes if this field does not exist than it will cause a problem.

Try to add pbs.conf.Exit_status field in csv filter under column and in your csv as well.

The problem is that it doesn't exist on it's own at the csv level - it's in the pbs.job_conf ("message") field, which is why I then use kv to split them out.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.