New Template vs Mutate vs Convert

Elastic Stack Elasticsearch
1

Hello,
I just installed this (Elastic-6 with included Logstash and Kibana) and I've been playing around with data from my DHCP server.

I'm able to send a csv (powershell created) using filebeat and parsing with logstash csv filter with no problems... I also discovered the data defaults to strings... using csv convert fixed that and all is great!

Now comes the question:
I want to have one of the fields "ScopeID" be an actual IP and not a number. I do not see this as something convert can do. So searching this website and others, seems the answer is to create a new Template.. OK.. WHY?

What is the difference between a new template and doing the conversion with mutate or convert? I haven't found any info on why/when one needs to create a new template and not leverage mutate or convert.

Not asking how to do it :wink: .. I just want to understand the why.

Thanks.

2

The index mapping (which you could define in an index template) tells Elasticsearch how it should treat the data that you send it. You could send Elasticsearch a string that should be treated as a date, as an IP address, or simply as a string. The mapping is the way to tell Elasticsearch that. Think of it as Elasticsearch' data schema.

The mutate and convert transformations are something you do to a document before you send it to Elasticsearch for indexing. You are changing the source document from containing a string like for example "42" to containing a number like 42.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.