# ElasticSearch--Not able to get duration field value in long format in ES index

**URL:** https://discuss.elastic.co/t/elasticsearch-not-able-to-get-duration-field-value-in-long-format-in-es-index/364179
**Category:** Elasticsearch
**Created:** [August 1, 2024, 3:55am UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-get-duration-field-value-in-long-format-in-es-index/364179 "2024-08-01T03:55:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Bhanu\_Praveen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhanu_praveen/32/60395_2.png) [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)
#### Post date: [August 1, 2024, 3:55am UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-get-duration-field-value-in-long-format-in-es-index/364179/1 "2024-08-01T03:55:04Z")

</div>

Elasticsearch--Not able to get duration field value in long format in ES index

Below is my json log string:

```auto
{
	"traceId": "o0uyveRU/8BkjL+lbpDlnQ==",
	"spanId": "73rmqIRmo34=",
	"operationName": "ProcessWorkItem",
	"startTime": "2024-07-22T06:07:12.650881409Z",
	"duration": "0.256620153s",
	"tags": [
		{
			"key": "otel.library.name",
			"vStr": "com.mdi.core.workmgmt.TypedConsumer"
		},
		{
			"key": "ta.work.type",
			"vStr": "INBOUND_ENTITY_INTEGRATION"
		},
		{
			"key": "ta.companyCode",
			"vStr": "AMBER_ROAD"
		},
		{
			"key": "ta.work.status",
			"vStr": "COMPLETED"
		},
		{
			"key": "ta.work.loadDuration",
			"vType": "INT64"
		},
		{
			"key": "service.version",
			"vStr": "24.2"
		},
		{
			"key": "work.processorclass",
			"vStr": "com.mdi.core.entity.integration.EntityStdIntegrationWorkProcessor"
		},
		{
			"key": "ta.work.receivedTime",
			"vType": "INT64",
			"vInt64": "1721628429423"
		},
		{
			"key": "ta.work.delegateDuration",
			"vType": "INT64",
			"vInt64": "257"
		},
		{
			"key": "ta.work.busKeySearch",
			"vStr": "AMBER_ROAD;SO_TEST_93;SALES_ORDER"
		},
		{
			"key": "ta.orgCode",
			"vStr": "AMBER_ROAD"
		},
		{
			"key": "ta.work.id",
			"vStr": "33267221"
		},
		{
			"key": "length",
			"vType": "INT64",
			"vInt64": "3680"
		},
		{
			"key": "ta.work.reportStatusDuration",
			"vType": "INT64",
			"vInt64": "4"
		},
		{
			"key": "ta.work.errorCount",
			"vType": "INT64"
		},
		{
			"key": "ta.work.delegateConsumerTime",
			"vType": "INT64",
			"vInt64": "253"
		},
		{
			"key": "span.kind",
			"vStr": "internal"
		},
		{
			"key": "otel.status_code",
			"vStr": "OK"
		},
		{
			"key": "internal.span.format",
			"vStr": "otlp"
		}
	],
	"process": {
		"serviceName": "TRADE_SINGLETON",
		"tags": [
			{
				"key": "deployment.environment",
				"vStr": "PSR"
			},
			{
				"key": "e2.environment.name",
				"vStr": "OTEL_PST"
			},
			{
				"key": "e2.instance.name",
				"vStr": "TRADE_SINGLETON_1"
			},
			{
				"key": "e2.product.family",
				"vStr": "GTM"
			},
			{
				"key": "e2.product.tenant.id",
				"vStr": "WMMERCURYTA"
			},
			{
				"key": "service.instance.id",
				"vStr": "URN:PSR:GTM:TA:OTEL_PST:TRADE_SINGLETON:TRADE_SINGLETON_1"
			},
			{
				"key": "service.namespace",
				"vStr": "TA"
			},
			{
				"key": "telemetry.sdk.language",
				"vStr": "java"
			},
			{
				"key": "telemetry.sdk.name",
				"vStr": "opentelemetry"
			},
			{
				"key": "telemetry.sdk.version",
				"vStr": "1.34.0"
			}
		]
	},
	"tag": "jaeger_spans"
}

```

In logstash filter removing "s" at the end and converting to floast as below:

```auto
 mutate 
	 {
		gsub => ["duration", "s", ""]
		convert => { "duration" => "float" }
	  }

```

In Index template, i have added field type as Numeric & numeric type as float in kibana. Sill getting duration field type as keyword with correct value.

If i change to long in index template, duration value coming as 0. Need output value in long format type. pls let me know how to handle?

---

<div class="post-metadata">

### Author: ![Musab\_Dogan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/musab_dogan/32/70691_2.png) [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)
#### Post date: [August 1, 2024, 9:41am UTC](https://discuss.elastic.co/t/elasticsearch-not-able-to-get-duration-field-value-in-long-format-in-es-index/364179/2 "2024-08-01T09:41:51Z")

</div>

Separate the `gsub` and `convert`.

```auto
filter { 
  mutate { gsub => ["duration", "s", ""] }
  mutate { convert => { "duration" => "float" } }
...
}

```