# Force field processing as "double" instead of "long"

**URL:** <https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 3, 2022, 6:15pm UTC](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220 "2022-02-03T18:15:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dror\_Tirosh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dror_tirosh/32/98379_2.png) [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\
**Post date:** [February 3, 2022, 6:15pm UTC](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220/1 "2022-02-03T18:15:56Z")

</div>

I try to load json-structured logs using filebeat into kibana.  
it parses OK, but some values are numeric with very large numbers.  
filebeat complains that  
`Value [40000000000000000000] is out of range for a long"}}, dropping event`

I was trying to force such field to be "double" and not "long" but it ignores the setting.

my "fields.yml" contains:

```auto
- key: getlogs
  title: Getlogs Results
  fields:
  - name: amount
    type: double

```

how can I make it work?  
(either recognize this field definition, or change the default numeric type to "double")

---

<div class="post-metadata">

**Author:** ![Dror\_Tirosh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dror_tirosh/32/98379_2.png) [@Dror\_Tirosh](https://discuss.elastic.co/u/Dror_Tirosh)\
**Post date:** [February 6, 2022, 11:08am UTC](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220/2 "2022-02-06T11:08:37Z")

</div>

fields.yml still doesn't work, but I found I can do it in filebeat configuration:

```auto
processors:
- convert:
    fields:
      - { from: amount, type: double }

```

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [February 7, 2022, 1:23pm UTC](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220/3 "2022-02-07T13:23:49Z")

</div>

Editing `fields.yml` directly does not work, unless you rebuild the whole package. Using `processors` solves the problem, but the optimal solution is to use `append_fields` to load your fields configuration.

You have to configuration `setup.template.append_fields` and reload the index template. Ref: [Configure Elasticsearch index template loading | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-template.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2022, 3:24pm UTC](https://discuss.elastic.co/t/force-field-processing-as-double-instead-of-long/296220/4 "2022-03-07T15:24:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.