Hi guys,
I have a log file that have a field named "Time", this field is filled sometimes with the word "IN" and other times with numbers that correspond to the time in milliseconds.
I find a way to convert the word to 0 using :
if[ResponseTime] == "IN"
{
mutate
{
replace => ["ResponseTime",0]
}
}
and than in my grok pattern I do :
%{NUMBER:ResponseTime}
and than I configure a mutate convert as follow :
convert => {
"ResponseTime" => "integer"
}
in that way I can convert the word IN to 0 but cannot make it integer.
Help please.