Change Graylog 'keyword' field to 'long'

Hi Community,

I am new to Graylog. I have a Graylog setup for the production. I’ve send there an object which has been parsed into multiple fields. One of these fields has a type ‘keyword’, but now I would like to have a numeric data in this field so I can create a graph. Can I just start sending the numeric data into that field or I need to convert a field somehow?

The easy way to deal with it is create a new field for graphing with the data and force it to be numeric - something like

set_field("new_field", to_long($message.old_field));

a little more challenging, create a custom mapping in Elasticsearch where you force that field in that index to be numeric (be sure to rotate the index after setting up the custom mapping):

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.