# Can't parsing 00 as number

**URL:** <https://discuss.elastic.co/t/cant-parsing-00-as-number/364360>\
**Category:** Elasticsearch\
**Created:** [August 5, 2024, 8:50am UTC](https://discuss.elastic.co/t/cant-parsing-00-as-number/364360 "2024-08-05T08:50:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [August 5, 2024, 8:50am UTC](https://discuss.elastic.co/t/cant-parsing-00-as-number/364360/1 "2024-08-05T08:50:54Z")

</div>

I have a log like this:

> 2024-08-05T15:21:55.061+07:00 X-Request-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx trace-id=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx span-id= INFO 1 --- [nio-8080-exec-8] i.c.p.logging.LoggingServiceImpl : RESPONSE method=[POST] path=[/xxxx/v1/inquiry/xxxxxx] responseHeaders=[{X-Request-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, X-Correlation-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}] responseBody=[{"responseCode":"00","responseDesc":"Approved","data":[{"branch":"X","channelId":"xxxx","clientId":"xxxx"}]}]`

This is a sample log with the data obfuscated. When the `responseCode` is not "00", it is successfully parsed. However, when the `responseCode` is "00", it returns a value of "-". I would like it to return the actual value, which is "00".

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [August 5, 2024, 12:44pm UTC](https://discuss.elastic.co/t/cant-parsing-00-as-number/364360/2 "2024-08-05T12:44:29Z")

</div>

Hello,

You need to provide a lot more of context.

What is not being parsed? How are you parsing it? Are you using Logstash? Are you using Elastic Search Ingest pipelines?

Please share this information.

---

<div class="post-metadata">

**Author:** ![zerratriani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerratriani/32/113308_2.png) [@zerratriani](https://discuss.elastic.co/u/zerratriani)\
**Post date:** [August 6, 2024, 2:35am UTC](https://discuss.elastic.co/t/cant-parsing-00-as-number/364360/3 "2024-08-06T02:35:13Z")

</div>

Sorry for the lack of clarity. I'm using Logstash, and here is the filter I'm using.

` match => ["message", "%{TIMESTAMP_ISO8601:timestamp} X-Request-ID=%{UUID:x_request_id} trace-id=%{DATA:trace_id} span-id=%{DATA:span_id} +%{LOGLEVEL:log_level} %{NUMBER:pid} --- \[%{DATA:thread_name}\] %{DATA:class} *: %{WORD:log_type} method=\[%{WORD:method}\] path=\[%{NOTSPACE:path}\] responseHeaders=\[\{%{DATA:responseHeaders}\}\] responseBody=\[%{DATA:responseBody}\]"]`

` grok { match => { "responseBody" => "responseCode":"%{NUMBER:responseCode}","responseDesc":"%{DATA:responseDesc}","data":%{GREEDYDATA:data}"} } }`