# Fields not being categorized properly **URL:** \ **Category:** Kibana\ **Created:** [January 30, 2018, 9:53pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708 "2018-01-30T21:53:41Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![lravelo](https://avatars.discourse-cdn.com/v4/letter/l/43a26b/32.png) [@lravelo](https://discuss.elastic.co/u/lravelo)\ **Post date:** [January 30, 2018, 9:53pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/1 "2018-01-30T21:53:42Z")
I'm new to the elastic stack. Trying to visualize some data from our squid proxies and am having trouble. I've set a field in the grok filter to specifically set the type to number like so: `%{NUMBER:reply_size_include_header}` But when I view the fields in the Kibana index patterns page, it's classifying it as a string and not a number so I can't do generate some graphs. The data itself is parsed correctly. I don't know enough about these products to know where to look. Anyone seen this kind of issue before? ---
**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\ **Post date:** [January 31, 2018, 2:13am UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/2 "2018-01-31T02:13:23Z")
When you say you set the field in the grok filter, where did you do this exactly? If you goto Management \> Index Patterns and select your index pattern. Then, click the refresh button in the top right-hand corner of the screen. After doing that, what does the row includes for this column? ---
**Author:** ![lravelo](https://avatars.discourse-cdn.com/v4/letter/l/43a26b/32.png) [@lravelo](https://discuss.elastic.co/u/lravelo)\ **Post date:** [January 31, 2018, 2:35am UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/3 "2018-01-31T02:35:10Z")
So in `/etc/logstash/conf.d` I created a .conf file for the squid logs and within the grok filter I specifically set for the `reply_size_include_header` field to be a number like shown in my first post. If I go to Management -\> Index Patterns and refresh it shows string for both the reply\_size\_include\_header and reply\_size\_include\_header.keyword fields. The value itself in the log is a number so it’s not like it needs to do any conversions. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 31, 2018, 3:09am UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/4 "2018-01-31T03:09:48Z")
> [@lravelo](#): > > %{NUMBER:reply\_size\_include\_header} That is not setting it as a number, try; ```auto %{NUMBER:reply_size_include_header:int} ``` ---
**Author:** ![lravelo](https://avatars.discourse-cdn.com/v4/letter/l/43a26b/32.png) [@lravelo](https://discuss.elastic.co/u/lravelo)\ **Post date:** [January 31, 2018, 2:21pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/5 "2018-01-31T14:21:36Z")
I tried this, restarted logstash, and it doesn't categorize this field as a number, unfortunately. ---
**Author:** ![lravelo](https://avatars.discourse-cdn.com/v4/letter/l/43a26b/32.png) [@lravelo](https://discuss.elastic.co/u/lravelo)\ **Post date:** [January 31, 2018, 4:39pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/6 "2018-01-31T16:39:09Z")
Now I'm noticing in Kibana that there's a conflict on the field type. The two choices that I have is URL and String which doesn't really make much sense at all. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 31, 2018, 9:08pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/7 "2018-01-31T21:08:03Z")
You may want to use stdout+rubydebug to see what the structure looks like. ---
**Author:** ![lravelo](https://avatars.discourse-cdn.com/v4/letter/l/43a26b/32.png) [@lravelo](https://discuss.elastic.co/u/lravelo)\ **Post date:** [February 2, 2018, 3:13pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/8 "2018-02-02T15:13:13Z")
> [@warkolm](#): > > stdout+rubydebug ok so I've configured the following output ``` output { stdout { codec => rubydebug } if [type] == "SQUID" { elasticsearch { hosts=> "localhost:9200" index => "logstash-squid-%{+YYYY.MM.dd}" } } } ``` where can I see the outputs? I figured they'd be in logstash-plain.log but I'm not seeing anything there. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2018, 3:13pm UTC](https://discuss.elastic.co/t/fields-not-being-categorized-properly/117708/9 "2018-03-02T15:13:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.