GROK NUMBER field type creating field as string and not number

[cchooks2 (Steven)]

I have a created a GROK pattern to parse out a "number" field on an access log, but when i look at the data in the kibana management console it is showing these fields as a string.

Any thoughts on this?

GROK pattern:

%{IP:client_ip}%{SPACE}%{DATA:client_port}%{SPACE}%{DATA:ident}%{SPACE}[%{EVENT_TS:event_ts}]%{SPACE}"%{WORD:method}%{SPACE}%{URIPATHPARAM:uri_path}%{SPACE}%{GREEDYDATA:version}"%{SPACE}%{NUMBER:status}%{SPACE}%{DATA:bytes}%{SPACE}%{NUMBER:request_time_in_secs}%{SPACE}%{NUMBER:keep_alives}%{SPACE}"%{GREEDYDATA:referer}"%{SPACE}"%{GREEDYDATA:user_agent}"%{SPACE}"%{GREEDYDATA:contenttype}"%{SPACE}%{GREEDYDATA:jsession_id}%{SPACE}%{IP:x_clientip}%{SPACE}%{NUMBER:response_time_in_secs}

Thanks.

[magnusbaeck (Magnus Bäck)]

This is expected. To get a number field, see this paragraph in the grok filter docs:

Optionally you can add a data type conversion to your grok pattern. By default all semantics are saved as strings. If you wish to convert a semantic’s data type, for example change a string to an integer then suffix it with the target data type. For example %{NUMBER:num:int} which converts the num semantic from a string to an integer. Currently the only supported conversions are int and float.