It would be handy to allow converters on Grok patterns.
For example, with the following pattern:
POSTFIX_PIPE_DELIVERED %{POSTFIX_QUEUEID:postfix_queueid}: %{GREEDYDATA:postfix_keyvalue_data} \(delivered via %{WORD:postfix_pipe_service} service\)
The field postfix_keyvalue_data will always contain key=value data. To extract this I currently need to create a copy extractor with a key/value converter on the resulting postfix_keyvalue_data field, duplicating a lot of information
Same for forcing the numeric type for use with statistics and charts.
+1, especially for casting to scalar types such as numbers for metrics
+1
The grok patterns already support type hints, for example %{NUMBER:num:int} will convert the match named "num" into an integer.
Currently the following types are supported:
bytebooleanshortintlongfloatdoubledatedatetimestring