Hello Team, we encountered an error while trying to convert a field to a string. We tried converting to string, but again we encountered same error.
Error - "generic::invalid_argument: pipeline failed: filter mutate (30) failed: replace failure: field \\"startTime.value\\": source field \\"startTime\\": source field value must be a string"
Please find the below code
if [startTime] != "" and [startTime] != "--" {
mutate {
convert => {
"startTime" => "string"
}
on_error => "status_already_string"
}
mutate {
replace => {
"startTime.key" => "Start Time"
"startTime.value" => "%{startTime}"
}
merge => {
"security_result.detection_fields" => "startTime"
}
}
}