Skip to content

[Processors] Type coercion of event fields #8124

@andrewkroh

Description

@andrewkroh

As a user I would like to be able to coerce field values to a specific type. When using the dissect processor with numeric values I would like to have them reported as numbers rather than strings.

In this example the process.pid value will be reported as a string rather than a number.

filebeat.inputs:
  - type: log
    paths:
      - data.log
    processors:
      - dissect:
          tokenizer: "pid=%{process.pid}"
          field: "message"
          target_prefix: ""

The Logstash's dissect process supports coersion with convert_datatype. Alternatively you could use a mutate filter to coerce.

Ingest node has a dedicated convert processor. https://www.elastic.co/guide/en/elasticsearch/reference/master/convert-processor.html

I think have a processor just for coercion would be good since you might want to use with with processors like decode_json_fields to correct the type of some value.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions