I’m trying to have some json fields typed/mapped as integer, but they keep ending up in Elastic as text fields. My setup:
Apache > logfile.json > filebeat > … Other side -> logstash > Elastic (6.7) > Kibana
My data is already parsed as json in Elastic so all fields are separately stored. The bytes fields are showing in the mapping defined as integers. However, looking at the data of a particular document in that index, they still appear as text fields. Anybody know what I’m missing?
I added my mapping that has the integer fields defined, but they don’t seem to work.
nb: I’ve tried to replace the mapping type name from
_doc and others, but still now luck.
Thanks a lot for any pointers!!
reindex json code
My test workflow
The sequence I follow for testing the mapping on the target destination
Delete target test index
curl -H 'Content-Type: application/json' -XDELETE http://127.0.0.1:9200/logstash-test-2019.05.10?pretty=true | jq .
Upload new mapping with bytes fields as integers
curl -H 'Content-Type: application/json' -XPUT 'http://127.0.0.1:9200/_template/logstash' -d @logstash-test-automapping.json | jq .
Reindex to target test index
curl -H 'Content-Type: application/json' -XPOST 'http://127.0.0.1:9200/_reindex' -d @reindex.json
Show the test mapping - Showing bytes fields as type integer
curl -H 'Content-Type: application/json' -XGET http://127.0.0.1:9200/logstash-test-2019.05.10?pretty=true | jq .
Getting a document from that index
curl -H 'Content-Type: application/json' -XGET http://127.0.0.1:9200/logstash-test-2019.05.10/_doc/ajQvpGoBz9QwF2Bdc9_I?pretty=true | jq .