With below code, and where by "linktargetport": "389(ldap)"
if ![no_linktargetport_found] {
mutate {
replace => {"targetport" => "%{linktargetport}"}
gsub => ["targetport", "[^0-9]", ""]
}
mutate {
convert => {"targetport" => "integer"}
}
mutate {
convert => {"targetport" => "string"}
}
mutate {
replace => {
"cse_event.idm.read_only_udm.target.port" => "%{targetport}"
}
}
}
}
this errors out with (the two converts was a suggestion from gemini...)
LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \"idm\": index 0: recursive rawDataToProto failed: field \"read_only_udm\": index 0: recursive rawDataToProto failed: field \"target\": index 0: recursive rawDataToProto failed: panic encountered: non-signed-integral type given for backstory.Noun.port: string \"389\""
With only the first convert, so only converting to integer
LOG_PARSING_CBN_ERROR: "generic::invalid_argument: pipeline failed: filter mutate (43) failed: replace failure: field \"cse_event.idm.read_only_udm.target.port\": source field \"targetport\": source field value must be a string"

