# Can I parse data with Elasticsearch?

**URL:** <https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499>\
**Category:** Elasticsearch\
**Created:** [May 23, 2019, 6:11pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499 "2019-05-23T18:11:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicks1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicks1993/32/84627_2.png) [@nicks1993](https://discuss.elastic.co/u/nicks1993)\
**Post date:** [May 23, 2019, 6:11pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499/1 "2019-05-23T18:11:19Z")

</div>

I am using the EFK stack at work. Mo one seems to know much about it.  
I struggled to get script fields working in kibana due to my field not being aggregatable I believe. I couldn't really figure out how to change the field to be aggregatable using dev tools. The person I am reporting to does not want to alter fluentd which I think is likely the best option to parse with, correct me if I am incorrect.  
What can I do with elasticsearch? Can I parse fields from there. I have a better chance of gaining access to ES config files than I do fluentd files.

this message field is what I am trying to parse. I want the time field parsed into a numeric field.

message: words::words::words (time=517, words)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 23, 2019, 9:34pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499/2 "2019-05-23T21:34:45Z")

</div>

You could look at using the ingest functionality to do this - [https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)

---

<div class="post-metadata">

**Author:** ![nicks1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicks1993/32/84627_2.png) [@nicks1993](https://discuss.elastic.co/u/nicks1993)\
**Post date:** [May 24, 2019, 3:56pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499/3 "2019-05-24T15:56:33Z")

</div>

Great thanks, I'll look into it

---

<div class="post-metadata">

**Author:** ![nicks1993](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicks1993/32/84627_2.png) [@nicks1993](https://discuss.elastic.co/u/nicks1993)\
**Post date:** [May 29, 2019, 1:09pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499/4 "2019-05-29T13:09:29Z")

</div>

Does Elastic have a slack or a gitter? I'm having a hard time wrapping my head around EFK/ELK stack and would like to be able to chat if that's an option

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 29, 2019, 9:24pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499/5 "2019-05-29T21:24:52Z")

</div>

We have IRC channels on Freenode.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 9:24pm UTC](https://discuss.elastic.co/t/can-i-parse-data-with-elasticsearch/182499/6 "2019-06-26T21:24:57Z")

</div>

Closed on June 26, 2019, 9:24pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.