# Mutate WinlogBeat

**URL:** <https://discuss.elastic.co/t/mutate-winlogbeat/93098>\
**Category:** Logstash\
**Created:** [July 14, 2017, 1:13am UTC](https://discuss.elastic.co/t/mutate-winlogbeat/93098 "2017-07-14T01:13:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nobby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nobby/32/18657_2.png) [@Nobby](https://discuss.elastic.co/u/Nobby)\
**Post date:** [July 14, 2017, 1:13am UTC](https://discuss.elastic.co/t/mutate-winlogbeat/93098/1 "2017-07-14T01:13:34Z")

</div>

Hey guys,

I'm trying to use mutate to define the data type of various fields generated in some Windows logs. For example, Remote Desktop Gateway has number fields for user\_data.BytesReceived, user\_data.BytesTransfered and user\_data.SessionDuration. I have the following config file for beats

```
input {
   beats {
     port => 5044
     ssl => true
    ssl_certificate => " *******"
    ssl_key => " *******"
  }
}
filter{
 mutate {                                                                                                              
  convert => ["user_data.BytesReceived", "integer"] 
  convert => ["user_data.BytesTransfered", "integer"] 
  convert => ["user_data.SessionDuration", "integer"] 
 }
}

```

After restarting Logstash and pushing new data through, I am not getting Mapping conflicts from the change. When I created a similar filter for my NGINX logs, a new filter was created automatically and showed mapping conflicts in Kibana. In the case of NGINX, i was using Filebeat with explicit an document\_type in the filter configuration for Logstash but prospectors don't seem to exist for Winlogbeat.

There are no errors in the Logstash logs. Is there anything I'm missing here?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2017, 6:53am UTC](https://discuss.elastic.co/t/mutate-winlogbeat/93098/2 "2017-07-14T06:53:48Z")

</div>

You're using the wrong syntax for nested fields, see [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).

I'm not sure integer values stored in string fields creates mapping conflicts.

---

<div class="post-metadata">

**Author:** ![Nobby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nobby/32/18657_2.png) [@Nobby](https://discuss.elastic.co/u/Nobby)\
**Post date:** [July 14, 2017, 7:21am UTC](https://discuss.elastic.co/t/mutate-winlogbeat/93098/3 "2017-07-14T07:21:50Z")

</div>

Hey Magnus,

Thanks for the doco pointer. I change the filter to:

```
input {
   beats {
     port => 5044
     ssl => true
    ssl_certificate => " *******"
    ssl_key => " *******"
  }
}
filter{
 mutate {                                                                                                              
  convert => ["[user_data][BytesReceived]", "integer"] 
  convert => ["[user_data][BytesTransfered]", "integer"] 
  convert => ["[user_data][SessionDuration]", "integer"] 
 }
}

```

And restarted Logstash. As you can see below, the types are still being detected as strings. A new index wasn't automatically created.  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/e/ceb770b6a2438b0020dbfcd76989edf2667fe9ec.png)

You get mapping conflicts when the index is originally of type string then you change to another type like date, integer, float etc which requires you to re-index old data against the new type.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 14, 2017, 7:46am UTC](https://discuss.elastic.co/t/mutate-winlogbeat/93098/4 "2017-07-14T07:46:51Z")

</div>

You can't change the mapping of an existing field. You have to reindex.

That aside, have you verified by looking at the JSON document being stored in ES that the `user_data` subfields are integers?

> You get mapping conflicts when the index is originally of type string then you change to another type like date, integer, float etc which requires you to re-index old data against the new type.

Numerical values can be stored in fields mapped as strings without creating mapping conflicts. The opposite isn't true.

Yes, if you want to change the mapping of a field you need to reindex but that's not a mapping conflict.

```plaintext
$ curl -XPOST localhost:9200/testindex/testtype/1\?pretty -d '{"stringfield": "hello"}'
{
  "_index" : "testindex",
  "_type" : "testtype",
  "_id" : "1",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  },
  "created" : true
}
$ curl -XPOST localhost:9200/testindex/testtype/2\?pretty -d '{"stringfield": 123}'   
{
  "_index" : "testindex",
  "_type" : "testtype",
  "_id" : "2",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  },
  "created" : true
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2017, 7:47am UTC](https://discuss.elastic.co/t/mutate-winlogbeat/93098/5 "2017-08-11T07:47:21Z")

</div>

Closed on August 11, 2017, 7:47am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.