Hello @ithfdemir:
Is this related to this thread?
Converting the incoming data element in a Graylog pipeline rule alone won’t accomplish what you’re looking for since ultimately the typing is determined by the Elasticsearch indexing. If the data element looks like a number it’s more likely that the field will store as a numerical type but Elasticsearch won’t be directly informed by the handling done in Graylog.
Your Graylog version is older than I have worked with so I can’t speak to process differences between 2.4.6 and what we’re on (4.0.6) or what I used initially (3.2.1) but we have been using custom index mappings with good success since the start.
https://docs.graylog.org/en/4.0/pages/configuration/elasticsearch.html#custom-index-mappings
To your question about the rule specifically, I’m looking at the logic and it looks correct to me.