长字段和浮动字段在Kibana中显示为文本字段

Question

正在运行Kibana 5.5.2版本。我目前的设置是Logstash从Docker容器中获取日志，在将日志发送到elasticsearch之前运行grok过滤器。我需要显示的特定日志长，浮动是从AWS调用ECS和EC2的两次，目前一个grok过滤器将它们拉出来。这里是拉出ECS计时的自定义过滤器:ECS_DESCRIBE_CONTAINER_INSTANCES (AWS)(%{SPACE})(ecs)(%{SPACE})(%{POSINT})(%{SPACE})(?<ECS_DURATION>(%{NUMBER}))(s)(%{SPACE})(?<ECS_RETRIES>(%{NONNEGINT}))(%{SPACE})(retries)，所以我需要ECS_DURATION是一个浮点数，ECS_RETRIES是一个长。在docker日志处理程序中，我有以下

if [ECS_DURATION] {
mutate {
convert => ["ECS_DURATION", "float"]
}
}
if [ECS_RETRIES] {
mutate {
convert => ["ECS_RETRIES", "integer"]
}
}

当我查看Kibana中的字段时，它仍然显示为文本字段，但是当我向elasticsearch发出以下请求以查找映射时，它将这些字段显示为长和浮动。

GET /logstash-2020.12.18/_mapping
{
"logstash-2020.12.18": {
"mappings": {
"log": {
"_all": {
"enabled": true,
"norms": false
},
"dynamic_templates": [
{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"norms": false,
"type": "text"
}
}
},
{
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"fields": {
"keyword": {
"ignore_above": 256,
"type": "keyword"
}
},
"norms": false,
"type": "text"
}
}
}
],
"properties": {
"@timestamp": {
"type": "date",
"include_in_all": false
},
"@version": {
"type": "keyword",
"include_in_all": false
},
"EC2_DURATION": {
"type": "float"
},
"EC2_RETRIES": {
"type": "long"
},
"ECS_DURATION": {
"type": "float"
},
"ECS_RETRIES": {
"type": "long"
},

我甚至用以下调用在elasticsearch中创建了一个自定义映射模板

PUT /_template/aws_durations?pretty
{
"template": "logstash*",
"mappings": {
"type1": {
"_source": {
"enabled": true
},
"properties": {
"ECS_DURATION": {
"type": "half_float"
},
"ECS_RETRIES": {
"type": "byte"
},
"EC2_DURATION": {
"type": "half_float"
},
"EC2_RETRIES": {
"type": "byte"
}
}
}
}
}

Answer 1

您检查过它实际上进入if [ECS_DURATION]和if [ECS_RETRIES]条件了吗?(我不能评论)