Closed
Description
As a user I would like to be able to coerce field values to a specific type. When using the dissect processor with numeric values I would like to have them reported as numbers rather than strings.
In this example the process.pid
value will be reported as a string rather than a number.
filebeat.inputs:
- type: log
paths:
- data.log
processors:
- dissect:
tokenizer: "pid=%{process.pid}"
field: "message"
target_prefix: ""
The Logstash's dissect process supports coersion with convert_datatype. Alternatively you could use a mutate filter to coerce.
Ingest node has a dedicated convert
processor. https://www.elastic.co/guide/en/elasticsearch/reference/master/convert-processor.html
I think have a processor just for coercion would be good since you might want to use with with processors like decode_json_fields
to correct the type of some value.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment