Elasticsearch index created with fieldtype mapping integer, recognized as "string" in Kibana 4

Question

I have created an index in elasticsearch 1.7 like this:

    curl -XPUT 'http://localhost:9200/test' -d '
{
    "test" : {
        "properties" : {
            "user" : {"type" : "string", "index" : "not_analyzed"},
            "message" : {"type" : "string", "null_value" : "na"},
            "syslogtimestamp" : {"type" : "date"},
            "transact" : {"type" : "integer"},
            "subscriber" : {"type" : "integer"},
            "pid" : {"type" : "integer"},
            "acquirertime" : {"type" : "float"}
        }
    }
}
'

I am populating it with data from logstash like this:

filter {
  if [type] == "test" {
    grok {
      match => { "message" => "%{TEST}" }
    }
geoip {
      source => "clientip"
      target => "geoip"
      database => "/etc/logstash/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float"]
    }

}
}

Pattern:
TEST %{MONTH:month} (?:(\s+|)) %{INT:day} %{TIME:time} (?<hostname>[a-z0-9_-]+) (?<application>[a-zA-Z0-9-_]+\.(cgi|pml|pfml)):(?:\s+)\[(?:(\s+|))%{INT:pid}\] %{IPORHOST:clientip} (?:\s+\()(?<acquirer>[a-zA-Z0-9_-]+)(?:(\s|))\) (?<event>[a-zA-Z0-9]+)(?:\s+)id=%{INT:transact}(?:\s+)sub=%{INT:subscriber}

So I am trying to get the field "transact" mapped in elasticsearch as an integer. However, when I look up the fields i Kibana 4, all of my fields are "string" types. How can this be?

Answer 1

You should look into ES index templates here: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html

You can have either logstash pass them on or feed them directly to elasticsearch via curl or config.