Once you have set the custom mapping to numeric and/or set the numeric_detection to true (and it works) you can use your current index but you must rotate the index and it will start trapping the field from that point onward as numeric… the previous indexes will still be keyword. If you want to correct your history to use it all, it’s possible… I posted my journey doing that here - it’s in an older version of Graylog/Elastic but I think it still holds. Be careful on production data!!!
1 Like