RequestElaspedTime

Elastic Stack Logstash
1

Recently upgraded log message include field requestElapsedTime to replaced elapsed_tme but from index pattern for requestElaspedTIme the type is 'string' only not 'number' for metric result.

I've added below on logstash conf.d to convert the field type as number and restarted logstash but 'number' field still not on list.

mutate { convert => { "requestElapsedTime" => "integer" } }

Can someone please advise.

Thanks

2

If an index already contains documents where that field is type string then even if logstash sends integers elasticsearch will convert them to string as it indexes them. Try rolling over to a new index.

3

OK, next roll over (ILM) is tonight I'll check tomorrow morning.

Yes already contains document i.e. requestElapsedTime=24 in log... and is type string where I want number.

4

Test from visualize I created metric, select index and add filter.

Field - requestElapsedTime / requestElapsedTime.keyword
Operator - is (there is no "is between")
Values - there are few numerical on list e.g. 24 (ms)

But I am looking for same set up as elapsed_time 'is between' from 0 to 4 range for SLA but not available for requestElapsedTime.

Please advise.

5

Can someone help with this topic?

6

What is your question?

7

For field name elapse_time there is type 'number' where I can select operator 'in between' or 'in not between' the number values. I want the same for requestElapsedTime.

8

if logstash sends integers, elasticsearch will converts field requestElapsedTime to string as it indexes them but I don't see the 'is between" & "is not between" operators on visualisation when create metric.

9

Use the mapping API, find the current mapping for requestElapsedTime field. What is the mapping?

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.