Convert field type
editConvert field type
editThe convert
processor converts a field in the event to a different type, such
as converting a string to an integer.
The supported types include: integer
, long
, float
, double
, string
,
boolean
, and ip
.
The ip
type is effectively an alias for string
, but with an added validation
that the value is an IPv4 or IPv6 address.
Example
edit- convert: fields: - {from: "src_ip", to: "source.ip", type: "ip"} - {from: "src_port", to: "source.port", type: "integer"} ignore_missing: true fail_on_error: false
Configuration settings
editElastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?
Name | Required | Default | Description |
---|---|---|---|
|
Yes |
List of fields to convert. The list must contain at least one item. Each item must have a |
|
|
No |
|
Whether to ignore missing |
|
No |
|
Whether to fail when a type conversion error occurs. If |
|
No |
Identifier for this processor. Useful for debugging. |
|
|
No |
|
When both |