}
it can't change the %{key} tpye
when i input [aass:123456]
it out put
{
"host" => "BIH-D-6331",
"@timestamp" => 2018-03-05T06:43:15.130Z,
"value1" => "123456",
"@version" => "1",
"message" => "[aass:123456]\r",
"aass" => "123456"
}
so if i want "aass" type is number
how can i do
Operating System:win filter {
grok{ match => [ "message","[(?[^:]]):(?[^]] )]"
]
}
mutate {
convert => ["value1", "float"]
} it can't change the %{key} tpye when i input [aass:123456] it out put { "host" => "BIH-D-6331", "@timestamp" => 2018-03-05T06:43:15.130Z, "value1" => "123456", "@version" => "1", "message" => "[aass:123456]\r", "aass" => "123456" } so if i want "aass" type is number how can i do