Tried "mutate" convert", logstash getting error from elasticsearch: "type [float] to [long]"

My expectation is that adding the 'convert' would insure that all data for that field will be of type "float", but I guess I did it wrong?

relevant part of data:

"metrics"=>[
	{
		"Unit"=>"Count", 
		"MetricName"=>"ResourceCount", 
		"Timestamp"=>"2021-11-22T15:31:50.684999", 
		"Value"=>2
	}, 
	{
		"Unit"=>"Seconds", 
		"MetricName"=>"ResourceTime", 
		"Timestamp"=>"2021-11-22T15:31:50.685014", 
		"Value"=>0.4867427349090576e0
	}, 
	{
		"Unit"=>"Count", 
		"MetricName"=>"PolicyException", 
		"Timestamp"=>"2021-11-22T15:31:51.170848", 
		"Value"=>1
	}
],

mutate:

    mutate {
        convert => {
            "[cc-data][metrics][Value]" => "float"
        }
        remove_field => ["message", "@timestamp", "@version", "host"]
    }

but got error:

Could not index event to Elasticsearch. {:status=>400,
...
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [cc-data.metrics.Value] cannot be changed from type [float] to [long]"}}}}

This has to be done in the index mapping. The data types in Logstash don't translate over to Elastic and are only used internally to Logstash.

Thank you so much for your help!

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.