ELK Type Conversion - Not a number but a string

Question

I'm trying to set up an elk dashboard to see some numbers like total bytes, avg load time, etc. I'm forcing some conversions in logstash to make sure these fields aren't strings

convert => [ "bytes", "integer" ]
convert => [ "seconds", "float" ]
convert => [ "milliseconds", "integer" ]

Those Logstash conversions are working. See this excerpt from my logstash.log. Statuscode is a string, bytes, ... are numbers

"http_statuscode" => "200",
"bytes" => 2731,
"seconds" => 0.0,
"milliseconds" => 9059,

But when I try to build my dashboard with avg, min, max and total bytes for instance elasticsearch logs this:

Facet [stats]: field [bytes] isn't a number field, but a string

Am I missing some kind of conversion or something? Anybody already expierenced this behavior?

Thanks gus yand regards. Sebastian

Alain Collins Alain Collins · Accepted Answer · 2015-02-06T16:14:39

One possible issue is that the mapping for fields in an index is set when the first document is inserted in the index. Changing the mapping will not update any old documents in the index, nor affect any new documents that are inserted into that index.

If you're in development, the easiest thing is to drop the index (thus deleting your earlier data). Any new documents would then use your new mapping.

If you can't toss the old data, you can wait for tomorrow, when you'll get a new index.

If necessary, you can also rebuild the index, but I've always felt it to be a pain.

One other possibility is that you have the same field name with different mappings in different types in the same index. [ repeat that a few times and it will make sense ]. Field [foo] must have the same mapping definition in each type of the same index.

ELK Type Conversion - Not a number but a string

2 Answers