# Add\_field is not working when trying to add interger value

**URL:** https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376
**Category:** Logstash
**Created:** [February 22, 2016, 10:54am UTC](https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376 "2016-02-22T10:54:11Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Sergey\_Grigorov](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Sergey\_Grigorov](https://discuss.elastic.co/u/Sergey_Grigorov)
#### Post date: [February 22, 2016, 10:54am UTC](https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376/1 "2016-02-22T10:54:11Z")

</div>

I'm trying to add\_field of integer type right after "match". But the output shows that this field is a string not integer as required. Here is the part of my filter configuration:  
...  
filter {  
if [type] == "xferlog" {  
grok {  
match =\> { "message" =\> "(?\w{3}\s\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4})\s%{DATA:transfer\_time}\s::ffff:%{IPV4:remote\_host}\s%{NUMBER:file\_size:int}\s/(?\<file\_name\>.\*)\s%{DATA:transfer\_type}\s%{DATA:special\_action\_flag}\s\_  
add\_field =\> { "numeric\_field" =\> 1 }  
}  
date {  
locale =\> "en"  
match =\> ["time", "EEE MMM dd HH:mm:ss YYYY"]  
target =\> "logTimestamp"  
timezone =\> "UTC"  
}  
mutate {  
remove\_field =\> ["path", "host"]

# add\_field =\> { "numeric\_field" =\> 1 }

```
# convert => { "numeric_field" => "integer" }

         }
       }

```

And here is the result after processing:  
"message" =\> "\*\*_**",  
"@version" =\> "1",  
"@timestamp" =\> "2016-02-22T08:53:28.846Z",  
"type" =\> "xferlog",  
"time" =\> "Tue Feb 09 00:16:14 2016",  
"transfer\_time" =\> "0",  
"remote\_host" =\> "**_.254",  
"file\_size" =\> 51784,  
"file\_name" =\> "\*\*\*\*\*\*.ZIP",  
"transfer\_type" =\> "binary transfer",  
"special\_action\_flag" =\> "\_",  
"direction" =\> "incoming",  
"access\_mode" =\> "real",  
"user\_name" =\> "\*\*\*\*\***",  
"service\_name" =\> "**",  
"authentication\_method" =\> "0",  
"completion\_status" =\> "completed",  
**"numeric\_field" =\> "1",**

The 'numeric\_field' is sting type but I need it to be integer. I've tried to use 'convert' but kibana shows the conflict with message mentioned on the picture below:  
'

 ![](https://us1.discourse-cdn.com/elastic/original/2X/6/69ad8e0be6defb97099e3d13f428177a8fb2ec8f.PNG)'  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f4f140a92f1854db678af98ef560ee5026170d26.PNG)

---

<div class="post-metadata">

### Author: ![vgondil](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vgondil/32/7557_2.png) [@vgondil](https://discuss.elastic.co/u/vgondil)
#### Post date: [February 22, 2016, 11:38am UTC](https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376/2 "2016-02-22T11:38:57Z")

</div>

Specify the type in your Elasticsearch index.  
See this blog entry :

> **[Little Logstash Lessons - Part I: Using grok and mutate to type your data
	  	 |...](https://www.elastic.co/blog/little-logstash-lessons-part-using-grok-mutate-type-data)**
>
> Logstash is an event processing pipeline, which features a rich ecosystem of plugins, allowing users to push data in, manipulate it, and then send it to various backends. One of those plugins is grok....

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376/3 "2017-07-06T05:10:19Z")

</div>