Supported field types?

Elastic Stack Logstash
1

Topic says it...specifically looking at mutate -> convert:

Convert a field’s value to a different type, like turning a string to an integer.

I'm suspecting that my config with converting to type "ip" is no longer supported? But I can't seem to find a list of what types of fields I can use. Thank you.

2

If your target is Elasticsearch, you'll have to use a mapping. Logstash is really only able to understand int (or integer), float, and string. These changes are used internally in Logstash to allow for mathematical operations on numbers, when they were originally seen as strings.

Additionally, integer and float field types can send properly typed values via JSON, since that is what Elasticsearch requires. Otherwise, Elasticsearch mappings would be needed to convert "10" to 10. Elasticsearch also uses mappings (and mapping templates), to convert "192.168.0.10" to an IP-type field. These mappings are also highly recommended as there are more numeric types besides integer and float. Choosing the correct java primitive type can save a lot of storage space (short vs. long, for example).

So, long story short, see the default mapping template provided by Logstash for insight into mapping an IP type.

3

Thank you as always Aaron. Looks like my mutate -> convert to type "ip" is no longer valid for logstash.

4

Mutating a field to type ip has never been valid. I'm not sure where you found that. Mutate filter plugin | Logstash Reference [8.11] | Elastic

Note the phrase:

Valid conversion targets are: integer, float, string, and boolean.

5

You're of course right...I think as this is my test setup I added that in...VERY good to know thanks again Aaron :slight_smile: