# Grok's strange data conversions **URL:** \ **Category:** Logstash\ **Created:** [August 28, 2017, 3:56pm UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582 "2017-08-28T15:56:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\ **Post date:** [August 28, 2017, 3:56pm UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582/1 "2017-08-28T15:56:27Z")
Hi, I have really weird conversions when using grok. I really don't get why the final values are so different from the originals: ![grok](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00358a08455824b8101a8c3068b14d9660252218.jpg) I use the DATA grok pattern because I sometimes have numbers with exponents (eg: 12.12e-5) that are not recognized with BASE16FLOAT. Is it a bug, or did I do something wrong? Thanks in advance! ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 29, 2017, 6:22am UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582/2 "2017-08-29T06:22:30Z")
It seems grok only uses single-precision floating point numbers and their precision is about seven digits. Maybe other parts of Logstash (the mutate filter or the ruby filter) use double-precision floats. BTW, don't sprinkle your grok expressions with DATA patterns like that. It's a real performance killer. Use a more exact expression or even a csv filter. ---
**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\ **Post date:** [August 29, 2017, 10:11am UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582/3 "2017-08-29T10:11:36Z")
Thank you Magnus! I'll try these solutions. About the DATA pattern, I didn't really had a choice since sometimes, a value is so tiny that is it in the form "6.32e-5"...and that is not matched by grok with the BASE16FLOAT pattern...maybe a custom pattern you be better? Or maybe dissect would be even better? According to the doc, if the lines structure is always the same, dissect could be a good choice. Is there a way to measure the logstash performances? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 29, 2017, 12:02pm UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582/4 "2017-08-29T12:02:06Z")
> maybe a custom pattern you be better? For example `(?[^;]+)` which extracts one or more characters up until the next semicolon. > Or maybe dissect would be even better? According to the doc, if the lines structure is always the same, dissect could be a good choice. Yes, or csv. > Is there a way to measure the logstash performances? Have a look at the monitoring API. ---
**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\ **Post date:** [August 29, 2017, 12:04pm UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582/5 "2017-08-29T12:04:38Z")
Thanks a lot!! 👍 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 26, 2017, 12:04pm UTC](https://discuss.elastic.co/t/groks-strange-data-conversions/98582/6 "2017-09-26T12:04:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.