Convert String to float failed


(Sayakiss) #1

My logstash config:

filter {
  grok {
    match => {"stack_trace" => "%{JAVACLASS:exception_class}: \[%{DATA:error_level}\]\[%{BASE10NUM:error_code}\]-%{GREEDYDATA:error_message}"}
  }
  grok {
    match => {"message" => "%{DATA:geo_message}: carrier=%{DATA:carrier}, province=%{DATA:province}, city=%{DATA:city}, location=%{BASE10NUM:latitude},%{BASE10NUM:longitude}"}
    add_tag => ["geo_parse_succeed"]
  }
  if "geo_parse_succeed" in [tags] {
    mutate {
      add_field => {"geoip.location" => ["%{longitude}","%{latitude}"]}
      convert => { "geoip.location" => "float" }
    }
  }
}

And the log:

  "_source": {
    "@timestamp": "2015-10-15T11:14:40.547+08:00",
    "@version": 1,
    "message": "New crawl task: carrier=CARRIER, province=provY, city=cityX, location=45.7656666,126.6160584",
    "level": "INFO",
    "level_value": 20000,
    "carrier": "CARRIER",
    "remoteIp": "127.0.0.1",
    "province": "provY",
    "tid": "40562a0a-558f-4a4a-b664-b5ef1a3cd565",
    "service": "crawler",
    "host": "192.168.5.130:56020",
    "type": "redis-input",
    "tags": [
      "_grokparsefailure",
      "geo_parse_succeed"
    ],
    "geo_message": "New crawl task",
    "city": "cityX",
    "latitude": "45.7656666",
    "longitude": "126.6160584",
    "geoip.location": [
      "126.6160584",
      "45.7656666"
    ]
  },

As you see, the element of geoip.location is still string(not float), but I don't see any error log from logstash..


Arithmetic with string
How to convert type for field like a.b in mutate plugin?
(Sayakiss) #2

I also tried:

convert => [ "geoip.location", "float" ]

it doesn't works, either.


Failed to convert the data type from string to float
How to convert type for field like a.b in mutate plugin?
(Magnus B├Ąck) #3
mutate {
  add_field => {"geoip.location" => ["%{longitude}","%{latitude}"]}
  convert => { "geoip.location" => "float" }
}

I'm not sure if these directives are necessarily processed in order. I'd try splitting this in two mutate filters (one with add_field and one with convert) just to make sure the field is added before we attempt to convert its type.


Get average of response time in specific interval
(Sayakiss) #4

Wow, it works after I split it to two mutate! Thank you very much!

It bothers me for a long time.


(system) #5