Thanks @sfentress for getting this re-opened (elastic stop autoclosing these).
As I said in private here is the solution:
You need to have two separate mutate statements, 1st one splits the string an creates an array.
2nd one converts the array to the desired type.
filter {
mutate {
split => { "available_cities" => "," }
}
mutate {
convert => { "available_cities" => "integer" }
}
}
This is the type of detail, that needs to be added to the documentation. Just add a note that a "seperate mutate must be performed AFTER the split operation".
Would save us all a lot of time and sanity...
Chris