# Grok - Integer data not being passed into fields when using :int

**URL:** <https://discuss.elastic.co/t/grok-integer-data-not-being-passed-into-fields-when-using-int/189877>\
**Category:** Logstash\
**Created:** [July 10, 2019, 9:49pm UTC](https://discuss.elastic.co/t/grok-integer-data-not-being-passed-into-fields-when-using-int/189877 "2019-07-10T21:49:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anda](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@anda](https://discuss.elastic.co/u/anda)\
**Post date:** [July 10, 2019, 9:49pm UTC](https://discuss.elastic.co/t/grok-integer-data-not-being-passed-into-fields-when-using-int/189877/1 "2019-07-10T21:49:06Z")

</div>

I've been using [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) to debug and learn grok patterns.

Input:  
10-07-19 14:06:00.025 SomeString 2963867553 3028425000 205809770 209513296 2298 2292 8 37 90 1562792747810 1562791897820 1562792701362 1562791807023

Pattern:  
%{TIMESTAMP\_ISO8601:logdate:} %{NOTSPACE:svc} %{INT:thisROPbytes:int} %{INT:lastROPbytes:int} %{INT:thisROPbytesTX:int} %{INT:lastROPbytesTX:int} %{INT:thisROPfiles:int} %{INT:lastROPfiles:int} %{INT:thisROPfailed:int} %{INT:lastROPfailed:int} %{INT:ROPcollectTime:int} %{INT:thisROPEndTime:int} %{INT:lastROPEndTime:int} %{INT:thisROPStartTime:int} %{INT:lastROPStartTime:int}

The fields for all int are empty, but when I take out the :int at the end of each definition, the fields will populate with the correct values. Can anyone explain what's going on?

Additionally, is using something like %{INT:data:int} redundant if I want the data to be passed as an integer to elasticsearch? Is the :int casting usually meant for if I am doing something like %{NUMBER:data:int}? I want to be able to aggregate the data when I'm finished so it's important that it's not passed as a string or something.

I'm new to Logstash/grok so any help/explanation would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 11, 2019, 12:11am UTC](https://discuss.elastic.co/t/grok-integer-data-not-being-passed-into-fields-when-using-int/189877/2 "2019-07-11T00:11:08Z")

</div>

Your pattern looks good to me. With this configuration

```
input { generator { count => 1 lines => ['10-07-19 14:06:00.025 SomeString 2963867553 3028425000 205809770 209513296 2298 2292 8 37 90 1562792747810 1562791897820 1562792701362 1562791807023'] } }

filter {
    grok { match => { "message" => "%{TIMESTAMP_ISO8601:logdate:} %{NOTSPACE:svc} %{INT:thisROPbytes:int} %{INT:lastROPbytes:int} %{INT:thisROPbytesTX:int} %{INT:lastROPbytesTX:int} %{INT:thisROPfiles:int} %{INT:lastROPfiles:int} %{INT:thisROPfailed:int} %{INT:lastROPfailed:int} %{INT:ROPcollectTime:int} %{INT:thisROPEndTime:int} %{INT:lastROPEndTime:int} %{INT:thisROPStartTime:int} %{INT:lastROPStartTime:int}" } }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

I get

```
    "thisROPbytes" => 2963867553,
    "thisROPfiles" => 2298,
  "ROPcollectTime" => 90,
             "svc" => "SomeString",
   "thisROPfailed" => 8,
"lastROPStartTime" => 1562791807023,
        "sequence" => 0,
    "lastROPbytes" => 3028425000,
  "lastROPbytesTX" => 209513296,
  "thisROPEndTime" => 1562792747810,
    "lastROPfiles" => 2292,
   "lastROPfailed" => 37,
  "lastROPEndTime" => 1562791897820,

```

etc., and there are no quotes around the numbers, so they are integers, not strings.

So what is the actual configuration and data you are testing with?

---

<div class="post-metadata">

**Author:** ![anda](https://avatars.discourse-cdn.com/v4/letter/a/c67d28/32.png) [@anda](https://discuss.elastic.co/u/anda)\
**Post date:** [July 11, 2019, 4:02pm UTC](https://discuss.elastic.co/t/grok-integer-data-not-being-passed-into-fields-when-using-int/189877/3 "2019-07-11T16:02:33Z")

</div>

I guess something must be up with the debugging application I've been using. It just doesn't seem to like to spit out integers as field values.

Configuration:

input {  
beats {  
port =\> 5044 // listening for logs same format as previous post  
}  
}

filter {  
if [message] =~ /=FileCollectionInstrumentation/ {

mutate { add\_field =\> { "[@metadata][ddctype]" =\> "pmservinstr" } }

grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:logdate:} %{DATA:svc} %{INT:thisROPbytes:int} %{INT:lastROPbytes:int} %{INT:thisROPbytesTX:int} %{INT:lastROPbytesTX:int} %{INT:thisROPfiles:int} %{INT:lastROPfiles:int} %{INT:thisROPfailed:int} %{INT:lastROPfailed:int} %{INT:ROPcollectTime:int} %{INT:thisROPEndTime:int} %{INT:lastROPEndTime:int} %{INT:thisROPStartTime:int} %{INT:lastROPStartTime:int}" }  
}

date {  
match =\> ["logdate", "dd-MM-YY HH:mm:ss.SSS"]  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["someIP"]  
index =\> "%{[@metadata][ddctype]}-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

It seems to work with Kibana just fine.. The graphs are being populated with the data. It was just odd to me that the data wasn't showing up when debugging.

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2019, 4:02pm UTC](https://discuss.elastic.co/t/grok-integer-data-not-being-passed-into-fields-when-using-int/189877/4 "2019-08-08T16:02:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.