Mutate multiple fields from multiple tables

Elastic Stack Logstash
1

Hi everyone!

After some time of fighting with logstash i managed to insert my sql server database to elastic. Im having some trouble when im emitting a field that looks like a phone number(a field with a "-" character) but its in fact and id...logstash reads it as a date field and send me errors(cause its out of a year range) . My question is the following...Is there a way to mutate a field from an specific table withing some nested tables?
My code is the following:
input{
jdbc{ one for each table in my DB)
}
}
filter{
mutate{
{ convert statement here to string
}
}
output{ }

Please be kind im a nooblord :sweat_smile:

2

It's Elasticsearch that (in this case incorrectly) autodetects the string as a date. To avoid this you need to explicitly set mappings, typically via an index template, that maps that field as a string.

3

Magnus,

Thanks for the reply! i manage to correct this issue. I ´m currently establishing a database from ms sql to elastic and i was wondering if there´s a way to apply mutate filters to several tables from my db in the conf file of logstash, and if there is one, whats the syntax to achieve it?. Thank you in advance!!

4

It's not clear what you want to achieve. "Tables" don't exist in the realm of Logstash and Elasticsearch and filters are applied to individual documents, which correspond to rows in a result set of a database query. If you could give an example of the kind of transforms you want to apply it would be possible to give a more specific answer.

5

thanks! was able to fix it by adding multiple "mutate"

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.