Ability to define data types for custom elasticsearch fields


It seems that any custom fields defined in logstash today (e.g. via grok) will end up as strings by default in elastic search. Some ES capabilities such as statistical facets naturally only work on numeric data types. It would be nice if in the grok filter you could define an optional data type and if present, logstash would use this when creating the ES index.

For now, as a work around, you can define an ES template for logstash and include your field data types in there. When logstash then creates a new index the custom fields will have the correct data type. If you define a new custom field in your logstash config you just need to make sure to update your ES logstash template if you want the value to be stored as something other than a string.

More on the available ES data types here: http://www.elasticsearch.org/guide/reference/mapping/core-types.html





Affects versions