# Grok Debugger requires ":integer" but logstash document says to use ":int" for format. Is ":integer" valid in logstash?

**URL:** <https://discuss.elastic.co/t/grok-debugger-requires-integer-but-logstash-document-says-to-use-int-for-format-is-integer-valid-in-logstash/159577>\
**Category:** Logstash\
**Created:** [December 5, 2018, 5:24pm UTC](https://discuss.elastic.co/t/grok-debugger-requires-integer-but-logstash-document-says-to-use-int-for-format-is-integer-valid-in-logstash/159577 "2018-12-05T17:24:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rducharme](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@rducharme](https://discuss.elastic.co/u/rducharme)\
**Post date:** [December 5, 2018, 5:24pm UTC](https://discuss.elastic.co/t/grok-debugger-requires-integer-but-logstash-document-says-to-use-int-for-format-is-integer-valid-in-logstash/159577/1 "2018-12-05T17:24:17Z")

</div>

I have a logstash configuration file with some mutates to map a matched pattern field to an integer.  
// mutate {  
// convert =\> {  
// "pages" =\> "integer"  
// "msec" =\> "integer"  
// }  
// }

The logstash document indicates I can use a format (:int) instead. However, when I try this in the grok debugger, specify a pattern as %{BASE10NUM:totalCount:int}, it does not detect a number field. If I change :int to :integer, it works fine. However the logstash documentation says to specify the format as ":int". Is this just a simple mismatch between the 2 tools or is ":integer" also valid for logstash?

When I do the match in logstash, it does seem to take the ":integer". However, I also have mutates in the configuration file to map the type to integer so not sure if it will really sending it as a number without the mutates.

---

<div class="post-metadata">

**Author:** ![Michel99\_7](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@Michel99\_7](https://discuss.elastic.co/u/Michel99_7)\
**Post date:** [December 6, 2018, 9:42am UTC](https://discuss.elastic.co/t/grok-debugger-requires-integer-but-logstash-document-says-to-use-int-for-format-is-integer-valid-in-logstash/159577/2 "2018-12-06T09:42:01Z")

</div>

- Grok uses "int"
- Convert function of "Mutate" plugin uses "integer"

---

<div class="post-metadata">

**Author:** ![rducharme](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@rducharme](https://discuss.elastic.co/u/rducharme)\
**Post date:** [December 7, 2018, 4:36pm UTC](https://discuss.elastic.co/t/grok-debugger-requires-integer-but-logstash-document-says-to-use-int-for-format-is-integer-valid-in-logstash/159577/3 "2018-12-07T16:36:29Z")

</div>

Mutate operation is fine. However, the question is the difference between the grok\_debugger and the grok pattern matching in logstash. If I specify int in the grok debugger, the number is not parsed. For 6.5.1 version of logstash (and some other versions), the :int in the pattern also does not seem to make it a number. I need to use the mutate to make it an integer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2019, 4:36pm UTC](https://discuss.elastic.co/t/grok-debugger-requires-integer-but-logstash-document-says-to-use-int-for-format-is-integer-valid-in-logstash/159577/4 "2019-01-04T16:36:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.