Cannot use percentile aggregation on custom double field

I added $request_time field to my Nginx access log without update the default mapping and used %{NUMBER:http.response.time:double} in Grok to parse it. I can use percentiles aggregation in DevTools on this field:


However, in bar chart visualization, I cannot use Range or Percentile in this field. I changed the aggregation to Term and figured out the Kibana see this field as String.

In addition, when I used TSVB, I still could apply Percentile on this field and now Kibana sees it as a number:

Does anybody know why I cannot use it with Percentile aggregation in Bar chart?
Thanks in advance.

Can you check the mapping and post it here? Kibana shouldn't really see a field as string if it's a numeric field in the mapping.

@Marius_Dragomir

I figured out that the currently supported number types for Grok are int and float. That's why when I used %{NUMBER:http.response.time:double} to parse the field, it got some problems at some points.
I changed the pattern to %{NUMBER:http.response.time:float} and it worked fine now.

Anyway, thank you very much for your response.

1 Like

Glad you got it all sorted out.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.