# After add\_field, conversion from string to float unsuccessful
**URL:** https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428
**Category:** Logstash
**Created:** [July 26, 2019, 12:03pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428 "2019-07-26T12:03:46Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@rj23495](https://discuss.elastic.co/u/rj23495)
#### Post date: [July 26, 2019, 12:03pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/1 "2019-07-26T12:03:47Z")
```
filter {
grok { match => { "message" => "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec} \[%{DATA:pool}\] %{DATA:metric} %{DATA:metricname} %{DATA:datatype} %{NUMBER:metricvalue:float} %{GREEDYDATA:unit}" } }
mutate {
copy => { "source" => "source_tmp" }
}
mutate {
add_field => { "metric_%{metricname}" => "%{metricvalue}" }
}
mutate {
convert => { "metric_%{metricname}" => "float" }
}
mutate {
split => ["source_tmp", "/"]
add_field => { "applicationID" => "%{[source_tmp][4]}" }
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 26, 2019, 12:29pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/2 "2019-07-26T12:29:25Z")
Correct. The convert function does not sprintf the LHS, so you cannot use field references. There are two open issues for that, [here](https://github.com/logstash-plugins/logstash-filter-mutate/issues/117) and [here](https://github.com/logstash-plugins/logstash-filter-mutate/issues/57).
---
### Author:  [@rj23495](https://discuss.elastic.co/u/rj23495)
#### Post date: [July 26, 2019, 1:11pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/3 "2019-07-26T13:11:25Z")
@Badger Thanks for your prompt reply.
What should be the work around for it?..
---
### Author:  [@rj23495](https://discuss.elastic.co/u/rj23495)
#### Post date: [July 26, 2019, 1:19pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/4 "2019-07-26T13:19:07Z")
@magnusbaeck any work arounds for this?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 26, 2019, 1:24pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/5 "2019-07-26T13:24:18Z")
The workaround would be to do it in ruby. Possibly with a regexp to match the key.
---
### Author:  [@rj23495](https://discuss.elastic.co/u/rj23495)
#### Post date: [July 26, 2019, 1:32pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/6 "2019-07-26T13:32:40Z")
@Badger any example to refer?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 26, 2019, 1:41pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/7 "2019-07-26T13:41:38Z")
```
ruby {
code => '
event.to_hash.each { |k, v|
if k =~ /^metric_/
if v.to_f.to_s == v
event.set(k, v.to_f)
end
end
}
'
}
```
---
### Author:  [@rj23495](https://discuss.elastic.co/u/rj23495)
#### Post date: [July 26, 2019, 1:53pm UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/8 "2019-07-26T13:53:58Z")
@Badger Thanks a lot i will try this filter in my configuration.
This requires KV filter? Because we have split the fields using grok.
message format is -------
"2019-07-23 08:00:15.965 [pool-2-thread-1] metric Address\_DATABASE\_SEARCH\_Country\_in int32 7 count"
---
### Author:  [@rj23495](https://discuss.elastic.co/u/rj23495)
#### Post date: [July 29, 2019, 6:12am UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/10 "2019-07-29T06:12:43Z")
@Badger
@magnusbaeck
if i use this
input {
beats {
port =\> 5044
}
}
```
filter {
grok { match => { "message" => "%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:min}:%{SECOND:sec} \[%{DATA:pool}\] %{DATA:metric} %{DATA:metricname} %{DATA:datatype} %{NUMBER:metricvalue:float} %{GREEDYDATA:unit}" } }
mutate {
copy => { "source" => "source_tmp" }
}
mutate {
add_field => { "message_tmp" => "metric_%{metricname} = %{metricvalue} %{unit}"}
}
grok { match => { "message_tmp" => "metric_%{DATA:metricname} = %{NUMBER:value:float}" } }
# mutate {
# add_field => { "metric_%{metricname}" => "%{metricvalue}" }
# }
#mutate {
#convert => { "metric_%{metricname}" => "float" }
# }
mutate {
split => ["source_tmp", "/"]
add_field => { "applicationID" => "%{[source_tmp][4]}" }
}
}
output {
elasticsearch {
hosts => ["xyz:9200"]
index => "%{[applicationID]}-%{+YYYY.MM.dd}"
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2019, 6:13am UTC](https://discuss.elastic.co/t/after-add-field-conversion-from-string-to-float-unsuccessful/192428/11 "2019-08-26T06:13:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.