Skip to content

[Processors] Type coercion of event fields #8124

Closed

Description

As a user I would like to be able to coerce field values to a specific type. When using the dissect processor with numeric values I would like to have them reported as numbers rather than strings.

In this example the process.pid value will be reported as a string rather than a number.

filebeat.inputs:
  - type: log
    paths:
      - data.log
    processors:
      - dissect:
          tokenizer: "pid=%{process.pid}"
          field: "message"
          target_prefix: ""

The Logstash's dissect process supports coersion with convert_datatype. Alternatively you could use a mutate filter to coerce.

Ingest node has a dedicated convert processor. https://www.elastic.co/guide/en/elasticsearch/reference/master/convert-processor.html

I think have a processor just for coercion would be good since you might want to use with with processors like decode_json_fields to correct the type of some value.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions