Tried "mutate" convert", logstash getting error from elasticsearch: "type [float] to [long]"

Elastic Stack Elasticsearch
1

My expectation is that adding the 'convert' would insure that all data for that field will be of type "float", but I guess I did it wrong?

relevant part of data:

"metrics"=>[
	{
		"Unit"=>"Count", 
		"MetricName"=>"ResourceCount", 
		"Timestamp"=>"2021-11-22T15:31:50.684999", 
		"Value"=>2
	}, 
	{
		"Unit"=>"Seconds", 
		"MetricName"=>"ResourceTime", 
		"Timestamp"=>"2021-11-22T15:31:50.685014", 
		"Value"=>0.4867427349090576e0
	}, 
	{
		"Unit"=>"Count", 
		"MetricName"=>"PolicyException", 
		"Timestamp"=>"2021-11-22T15:31:51.170848", 
		"Value"=>1
	}
],

mutate:

    mutate {
        convert => {
            "[cc-data][metrics][Value]" => "float"
        }
        remove_field => ["message", "@timestamp", "@version", "host"]
    }

but got error:

Could not index event to Elasticsearch. {:status=>400,
...
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [cc-data.metrics.Value] cannot be changed from type [float] to [long]"}}}}
2

This has to be done in the index mapping. The data types in Logstash don't translate over to Elastic and are only used internally to Logstash.

3

Thank you so much for your help!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.