But I now the index is full of empty fields, with the correct time range, whereas before these fields were full. attributes.forceId has some null data but is filled with 0,1, and 2's. Not sure why the data isn't showing up after adding the runtime field described above.
"Cannot invoke \"String.length()\" because \"v\" is null"
Hi Jsanz, I'm sorry but I don't really understand where you run the code you showed above. I'm using Kibana. The data I'm being sent is logs generated by other containers that eventually makes its way to Kibana, so I don't understand how to reproduce your test.
Is there a different engine, like at the command line with a logstash build, where you're executing the above?
Sorry, I was not explicit about that. The code shared above is expected to be run from the Kibana Console in the Dev Tools section of the Management block in the Kibana sidebar. That application is independent of Logstash.
Hey, I'm actually not sure of the problem, as from what I can see in discover, all of the forceID's are 0's, 1's, or 2's; but I'm solving this problem by translating the forceID in a logger that preprocesses the data being sent to kibana.
Thanks for your help though! I'm sure I'll have more questions soon enough.