elasticsearch type conversion -
not clear me how upload data thru logstash elasticsearch proper 'type'
i mean, have file syslog message including part date: use grok in logstash parse string identifying %date , other parts of message, send output elasticsearch {}: date in elsaticsearch appears string , not date. data qualifyed right type in elsaticsearch. same happens other fileds, if parsed grok int, date, etc thay appears string in elasticsearch how solve this?
thanks in advance
franco
the typical thing date logfile replace @timestamp value. first, use grok{} make field out of it, , feed date{} filter.
if need create second date field in event, can specify "target" in date{} filter put result in field of choice.
Comments
Post a Comment