Convert field type
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
The convert processor converts a field in the event to a different type, such as converting a string to an integer.
The supported types include: integer, long, float, double, string, boolean, and ip.
The ip type is effectively an alias for string, but with an added validation that the value is an IPv4 or IPv6 address.
- convert:
fields:
- {from: "src_ip", to: "source.ip", type: "ip"}
- {from: "src_port", to: "source.port", type: "integer"}
ignore_missing: true
fail_on_error: false
Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?
| Name | Required | Default | Description |
|---|---|---|---|
fields |
Yes | List of fields to convert. The list must contain at least one item. Each item must have a from key that specifies the source field. The to key is optional and specifies where to assign the converted value. If to is omitted, the from field is updated in-place. The type key specifies the data type to convert the value to. If type is omitted, the processor copies or renames the field without any type conversion. |
|
ignore_missing |
No | false |
Whether to ignore missing from keys. If true and the from key is not found in the event, the processor continues to the next field. If false, the processor returns an error and does not process the remaining fields. |
fail_on_error |
No | true |
Whether to fail when a type conversion error occurs. If false, type conversion failures are ignored, and the processor continues to the next field. |
tag |
No | Identifier for this processor. Useful for debugging. | |
mode |
No | copy |
When both from and to are defined for a field, mode controls whether to copy or rename the field when the type conversion is successful. |