Ok pipeline field rewrite rule is not necessary in my case, because indeed Graylog/Elasticsearch does treat a numeric json value as numeric on store, provided the original value seen is numeric to begin with, and I can do numeric operations on them like Generate Chart. I’ll have to rewrite all my json to not quote numeric fields if I want to most efficiently take advantage of this.
Following this old thread it was suggested to “roll the index” or “cycle the deflector.” I disabled my pipeline rule, and, when I didn’t see these exact StarTrek-like options in 2.3, on a gander I selected Rotate Active Index from the index Maintenance menu, limited my search to a short window after, and I am able to Generate Chart from the now numeric values.
Thanks!
-Bronius