Why graylog convert my INT to String

[loicattena]

Hi,

I’am sending logs to Graylog by Gelf who are streamed to OpenSearch.
The problem is that Graylog display the fields who has been sent as int as string.

For example, if I sent : {“version”:“1.1”, “host”: “little bird”, “short_message”: “Warrior from the North”, “level”:1, “_cpm”: 10}
The “_cpm” field will be saved as string in graylog and opensearch but I sent a integer.

Someone already got this problem ?

Thanks

[tmacgbay]

ElasticSearch will guess at they type of field at the creation of each Index, I am reasonably sure that OpenSearch is the same. If you rotate the index, it will choose type anew… so if you are forcing a long, it should capture as a long on the creation of the next index.

Assuming that works, It is possible to correct a field to a long historically if you want… Here is a write up for an older version but it likely can be used in OpenSearch with a little tweaking.