[SOLVED] The filter plugin mutate-convert doesn't work in 5.0

Elastic Stack Logstash
3

Still doesn't work. I try to explain the problem again:
I have a log file with key-value entries. Something like:

timestamp="18.07.2016 15:48:09,614" id="3" name="duration" type="DURATION" valueType="long" valueLong=79

Using logstash I write in two indices in Elastic:

  • one that contains the row data, something like:

    "type" => "DURATION",
    "@timestamp" => 2016-07-18T13:48:09.614Z,
    "valueLong" => 79,
    "valueType" => "long",
    "@version" => "1",
    "name" => "duration",
    "id" => "3"

  • and the second one, we call it summary index and the documents inside look like:

    "type" => "SUMMARY",
    "@timestamp" => 2016-07-18T13:48:09.614Z,
    "@version" => "1",
    "duration" => {
    "valueType" => "long",
    "id" => "3",
    "long" => 79 // this attribute is now inserted as String
    }

If another entry with the same ID will be logged, the first index will contain another document, but the second will update the existing one. Normally when this happens, the name is different and another structure will be created.

And exactly this functionality worked with Logstash < 5.0 using this code:

   mutate {
        add_field => { "[%{name}][long]" => "%{valueLong}" }
        remove_field => [valueLong]
        convert => ["[%{name}][long]", "integer"]
    }

I changed now, as you proposed to ...

        mutate {
            add_field => { "[%{name}][long]" => "%{valueLong}" }
        }
        mutate {
            remove_field => [valueLong]
        }
        mutate {
            convert => ["[%{name}][long]", "integer"]
        }

... but no change at all. duration.long is still a text.