Unable to mutate values to integer_range

Hi all,

I'm trying to "convert" two integer values to a range with mutate without success...
Range is a recent functionality, I'm unable to find any working syntax in the documentation.

values : 2 integers in [eng][rs] and [eng][re]
destination [eng][range]

Syntax, configuration &log below. Please can someone tell me what's wrong with my logstash syntax?
Do not hesitate to tell me if I'm not clear ;o)


My template :
"eng": {
"dynamic": true,
"properties": {
"rs": {
"type": "integer"
"re": {
"type": "integer"
"slrange": {
"type": "integer_range"

My logstash filter :
filter {
if [path] =~ //+(?:[+\ ]|%20)*eng.k/ {
mutate {
add_field => { "[eng][range]" => { "gte" => %{[eng][rs]} "lte" => %{[eng][re]} } }
# trying with the following syntax: same error
# add_field => { "[eng][slrange]" => { "gte" => 10 "lte" => 20 } }
# add_field => { "[eng][slrange]" => { "gte" => 10, "lte" => 20 } }

Logstash log :
[2017-05-22T17:53:15,303][WARN ][logstash.outputs.elasticsearch] Failed action. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"engagement-2017", :_type=>"logs", :_routing=>nil}, 2017-05-22T15:53:13.000Z %{host} - - [22/May/2017:17:53:13 +0200] "GET /eng.k?s=plop1&m=9d562d41cde38d78&f=2820046521&u=plop&t=hls&q=720p&rs=150&re=240 HTTP/1.1" 404 935 "-" "curl/7.38.0" 0], :response=>{"index"=>{"_index"=>"engagement-2017", "_type"=>"logs", "_id"=>"AVww3MsMxqoY7doNaybz", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [eng.range]", "caused_by"=>{"type"=>"mapper_parsing_exception", "reason"=>"error parsing field [eng.slrange], expected an object but got null"}}}}}

No idea where I'm wrong?

Have you tried?

add_field => { "[eng][slrange][gte] "=> "%{[eng][rs]", "[eng][slrange][lte]" => "%{[eng][re]" }

Not tested.

I find it is best to think of the the add_field function as (in a Tree datatype) adding values to leaf positions as opposed to adding sub-trees. The LHS describes the path to the leaf node and the RHS is a scalar value.

Many thanks for your answer Guy.

I added the right syntax in my mutate filer:
add_field => {
"[eng][slrange][gte]" => "%{[eng][rs]}"
"[eng][slrange][lte]" => "%{[eng][re]}"

Values are now inserted in my documents.

I changed my stand and do not use integer_range fields. I wrote a ruby filter and found queries that fit my needs.
I'm unable to check range specific queries since it need my ES template to be changed, which is not possible right now. Will check that before last index scratch ;o)

Thanks again, best.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.