Hi, using ELK 5.6.16 on Ubuntu 16.04.
I'm trying to figure out a way to ingest json where a field learn
is of type integer
. Once in a while an event will come in and that field's value is not an integer but instead a string, yes
or no
.
I want to change/convert those values to integers 0
or 1
as needed.
Since the field type is integer
I evidently cannot use mutate gsub
because the field type isn't string
.
Various attempts to use mutate convert boolean/integer
have no effect on the event data, and the data is ingested unchanged.
Here's a sample of an event:
{"env": "rtl433", "time": "1606424172", "protocol": 36,"model": "Test-Device","id": 1, "battery_ok": "current": 5.099,"interval": 6,"learn": "no","mic": "CHECKSUM","mod": "FSK","freq1": 433.957,"freq2": 433.886,"rssi": -8.079,"snr": 16.212,"noise": -24.291}
I tried:
filter{
json {
source => "message"
id => "rtl433"
add_tag => [ "JSON", "rtl433" ]
}
mutate{
convert => ["learn","boolean"]
}
mutate {
convert => ["learn","integer]
}
}
with the expectation that the values of yes
and no
would be converted per the documentation at https://www.elastic.co/guide/en/logstash/5.6/plugins-filters-mutate.html#plugins-filters-mutate-convert but this has no effect on the event data, and I don't know if it's because the field type is integer according to elasticsearch.
Can anyone shed some insight how I can achieve my goal, thanks!