# Field marked as number, but index is having it as string

**URL:** <https://discuss.elastic.co/t/field-marked-as-number-but-index-is-having-it-as-string/58952>\
**Category:** Logstash\
**Created:** [August 25, 2016, 3:58pm UTC](https://discuss.elastic.co/t/field-marked-as-number-but-index-is-having-it-as-string/58952 "2016-08-25T15:58:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmalired](https://avatars.discourse-cdn.com/v4/letter/r/e495f1/32.png) [@rmalired](https://discuss.elastic.co/u/rmalired)\
**Post date:** [August 25, 2016, 3:58pm UTC](https://discuss.elastic.co/t/field-marked-as-number-but-index-is-having-it-as-string/58952/1 "2016-08-25T15:58:23Z")

</div>

Hi, I running into an issue where my grok expression stays a particular field as NUMBER, but when the data is loaded into elastic search it is getting marked as string.

below is the configuration

grok Pattern  
WEBLOGIC\_ACCESS\_TS %{YEAR}-%{MONTHNUM}-%{MONTHDAY}\t%{TIME}  
WEBLOGIC\_EXTENDED\_ACCESS %{WEBLOGIC\_ACCESS\_TS:accesstimestamp}\t%{NUMBER:responsetime}\t%{WORD:verb}\t%{GREEDYDATA:request}\t%{NUMBER:httpstatus}

then my logstash filter config is as below

grok{  
patterns\_dir =\> "C:\Elastic\logstash\patterns"  
match =\> {"message" =\> "%{WEBLOGIC\_EXTENDED\_ACCESS}"}  
}

```
        mutate{
            gsub =>["accesstimestamp", "\t", " "]

        }

        date{
            match => ["accesstimestamp", "YYYY-MM-dd HH:mm:ss"]
            target => "@timestamp"
         }

```

my index in kibana shows as string

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f683c57422aef525a0522d545cbfe1a6e9717fc2.png)

Am I missing something ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 25, 2016, 4:57pm UTC](https://discuss.elastic.co/t/field-marked-as-number-but-index-is-having-it-as-string/58952/2 "2016-08-25T16:57:27Z")

</div>

NUMBER is just a shortcut for a regular expression that matches numbers. The captured field will still be a string. To convert the captured string into an integer use `%{NUMBER:httpstatus:int}`. See the grok filter documentation.

Field mappings are immutable so you'll have to reindex (or wait until the next day if you have daily indexes) to actually get an integer field.

---

<div class="post-metadata">

**Author:** ![rmalired](https://avatars.discourse-cdn.com/v4/letter/r/e495f1/32.png) [@rmalired](https://discuss.elastic.co/u/rmalired)\
**Post date:** [August 26, 2016, 3:55am UTC](https://discuss.elastic.co/t/field-marked-as-number-but-index-is-having-it-as-string/58952/3 "2016-08-26T03:55:35Z")

</div>

that helps

rakesh malireddy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/field-marked-as-number-but-index-is-having-it-as-string/58952/4 "2017-07-06T04:41:30Z")

</div>