# Conversion type pipeline **URL:** \ **Category:** Elasticsearch\ **Created:** [September 15, 2020, 9:20am UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638 "2020-09-15T09:20:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\ **Post date:** [September 15, 2020, 9:20am UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/1 "2020-09-15T09:20:09Z")
Hello, I'm trying to write a pipeline to parse following part of data ```auto ua="192.168.211.109:443" ``` I implement it as ```auto ua=\"%{IP:wkaddress}:%{NUMBER:port:integer}\" ``` but always I have wkaddress and port as Text field. When I try its using simulate in develop tools port appears as integer but into the log it always is set up as text. Someone have the same problem? best regards ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [September 15, 2020, 10:46am UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/2 "2020-09-15T10:46:02Z")
Have you checked your mappings? This looks more a Elasticsearch question but anyhow, I've done the following test and it worked as expected (7.9.1). From the DevTools console: - Create an index with a strict mapping with IP and port fields - Create a pipeline that processes a message like yours and extract the fields - Simulate the pipeline to be sure it works - Test the pipeline with a new document - Perform a IP range search to ensure the document is returned Does this help? * * * ```auto PUT testing_ip { "settings": { "index": { "number_of_shards": 1, "number_of_replicas": 1 } }, "mappings": { "dynamic": "strict", "properties": { "ip": { "type": "ip" }, "port": { "type": "integer"} } } } PUT _ingest/pipeline/parseip { "description": "Parsing ua=\"ip:number\" message type", "processors": [ { "kv": { "field": "message", "field_split": " ", "value_split": "=" } }, { "dissect": { "field": "ua", "pattern": "\"%{ip}:%{port}\"" } }, { "convert": { "field": "port", "type": "integer" } }, { "remove": { "field": "message" } }, { "remove": { "field": "ua" } } ] } POST /_ingest/pipeline/parseip/_simulate { "docs": [ { "_index": "index", "_id": "id", "_source": { "message": "ua=\"192.168.211.109:443\"" } } ] } POST testing_ip/_doc?pipeline=parseip { "message": "ua=\"192.168.211.109:443\"" } GET testing_ip/_search { "query": { "term": { "ip": "192.168.0.0/16" } } } ``` ---
**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\ **Post date:** [September 15, 2020, 11:43am UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/3 "2020-09-15T11:43:28Z")
Yes also in my solution into devTools it is works but it does not work in log parsing and I have example port as string ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [September 15, 2020, 12:00pm UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/4 "2020-09-15T12:00:08Z")
I'm afraid is hard to tell anything else with more details. Could you share the relevant bits of your pipeline and the mapping of your index? ---
**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\ **Post date:** [September 15, 2020, 1:42pm UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/5 "2020-09-15T13:42:12Z")
Es. this do not works ```auto %{DATA:bodybytes} { "convert" : { "field" : "bodybytes", "type" : "long", "on_failure" : [ { "set" : { "field" : "bodybytes", "value" : -1 } } ] } } ``` in the same pipeline this works and wkhttpstatus is presented as number ```auto uhs=\"%{DATA:wkhttpstatus}\" { "convert" : { "type" : "long", "on_failure" : [ { "set" : { "value" : -1, "field" : "wkhttpstatus" } } ], "field" : "wkhttpstatus" } } ``` ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [September 15, 2020, 2:15pm UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/6 "2020-09-15T14:15:11Z")
Moving this to the `Elasticsearch` forum since this is not Kibana related. My suggestion would be to try to reproduce your parsing error in the simplest and reproducible environment, try to use the `/_ingest/pipeline/{your_pipeline}/_simulate` to get your pipeline working as you expect, then maybe create a new index with the mapping with `dynamic: strict` to avoid types that you don't want and test your documents on that index and see if that works. Sorry but running out of ideas with the information available. ---
**Author:** ![graimato](https://avatars.discourse-cdn.com/v4/letter/g/9e8a1a/32.png) [@graimato](https://discuss.elastic.co/u/graimato)\ **Post date:** [September 15, 2020, 2:23pm UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/7 "2020-09-15T14:23:11Z")
Do not worry thanks for your time best regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 13, 2020, 2:23pm UTC](https://discuss.elastic.co/t/conversion-type-pipeline/248638/8 "2020-10-13T14:23:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.