# Winlogbeat 7.13.0 expected int but got type string in equals condition

**URL:** <https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 27, 2021, 11:05pm UTC](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273 "2021-05-27T23:05:31Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![VamPikmin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vampikmin/32/22367_2.png) [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Post date:** [May 31, 2021, 7:12am UTC](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273/3 "2021-05-31T07:12:39Z")

</div>

Sorry I've been meaning to post.

I've spent all weekend reindexing (GBs of data..) so I could do more tests after I delete the winlogbeat-\*  
(From what I gather that's the only way since you can't just change the field type on existing indices)

For starters you will have to change this for sure:

```auto
 - equals.winlog.event_id: 4634

```

to

```auto
- contains.winlog.event_id: "4634"

```

Since "winlog.event\_id" is now a string

- The `contains` condition checks if a value is part of a field. The field can be a string or an array of strings. The condition accepts only a string value.

> **[Define processors | Winlogbeat Reference \[7.13\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/defining-processors.html)**

I still have another cluster to upgrade, will make the change in the winlogbeat config first and see whether that's sufficient. I have a feeling it's not as after reindexing the field type is correct (text)

```auto
{
  "winlogbeat-7.13.0-2021.05.29" : {
    "mappings" : {
      "event.code" : {
        "full_name" : "event.code",
        "mapping" : {
          "code" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      },
      "winlog.event_id" : {
        "full_name" : "winlog.event_id",
        "mapping" : {
          "event_id" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      }
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/winlogbeat-7-13-0-expected-int-but-got-type-string-in-equals-condition/274273)._