It was bad syntax on mutate.
According to [SOLVED] The filter plugin mutate-convert doesn't work in 5.0, the syntax should be:
filter {
if "TimeSince" in [metric_path] or "Delay" in [metric_path] {
mutate { add_field => { "time_in_seconds" => "%{metric_value_string}"} }
mutate { gsub => ["time_in_seconds", ".0 secs", ""] }
mutate { convert => ["time_in_seconds", "integer"] }
}
}
instead of
filter {
if "TimeSince" in [metric_path] or "Delay" in [metric_path] {
mutate { add_field => { "time_in_seconds" => "%{metric_value_string}"} }
mutate { gsub => ["time_in_seconds", ".0 secs", ""] }
mutate { convert => { "time_in_seconds", "integer" } }
}
}
The incorrect syntax is listed here @ https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-convert