Status field in JSON filter must be numeric not string

Elastic Stack Logstash
1

Logstash version: 1.5.4

When passing parseable JSON to logstash where the field "status" is a string I get the error "failed action with response of 400, dropping action".

Passing the "status" field as a numeric type (integer or float) I get no such error and the log makes it in to elasticsearch.

I can see why you would expect HTTP status codes to be numeric (integer specifically) but I think this is a bug as a field with such a generic name as "status" should not be only considered a numeric value in such a generic filter as JSON. In fact it shouldn't drop any JSON that correctly parses.

Thoughts?

2

What do your ES logs show?

3

The problem has nothing to do with the json filter. It's most likely ES's mapping of the status field.