Get Type

Convert

Synopsis

Writes the runtime type name of a field's value into a target field, using KQL type naming.

Schema

- get_type:
    field: <ident>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field to inspect
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_field	N	field	Field to store the type name. Defaults to field, replacing the value with its type

Details

The name written is one of:

Type name	Value
string	Text
bool	true or false
long	Any integer
real	A number with a fractional part
datetime	A parsed timestamp
dictionary	An object
array	An array
null	A present field holding null

Two behaviours are worth knowing before branching on the result:

A whole-numbered float reports long, not real. The check is on the value, not the storage: 3.0 is indistinguishable from 3 here, and only a genuine fractional part such as 3.5 yields real. This follows KQL's gettype, and it means you cannot use this processor to detect that a field was encoded as a float.

An unrecognized type falls back to string rather than failing. The result is always one of the names above, so a downstream comparison never has to handle an unexpected value.

A missing field is an error, not null — null is reserved for a field that exists and holds a null value. Use ignore_missing to pass over absent fields.

Examples

Inspecting a Value

Recording what a field actually holds...	{ "port": 443 } - get_type: field: port target_field: port_type
using KQL type names:	{ "port": 443, "port_type": "long" }

Guarding a Conversion

Checking a field's type before treating it as an array...	{ "tags": "single-value" } - get_type: field: tags target_field: tags_type - append: if: "tags_type == 'string'" field: tags value: []
so a scalar that should have been a list can be normalized:	{ "tags": ["single-value"], "tags_type": "string" }

Whole-Numbered Floats

A float with no fractional part reports as long...	{ "ratio": 3.0, "latency": 3.5 } - get_type: field: ratio target_field: ratio_type - get_type: field: latency target_field: latency_type
and only a genuine fraction reports real:	{ "ratio": 3.0, "latency": 3.5, "ratio_type": "long", "latency_type": "real" }