# How to convert KVpair value from string to an integer in logstash pipeline

**URL:** https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421
**Category:** Logstash
**Created:** [August 22, 2019, 11:14pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421 "2019-08-22T23:14:59Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [August 22, 2019, 11:14pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/1 "2019-08-22T23:14:59Z")

</div>

I have a setup as below

```
source for kvpair: Duration: {2297} | Kernel: {171} | User: {1218}

```

KVblock is as below

```
      kv {
        trim_value => " {}\r\n"
        trim_key => " \r\n"
        value_split => ":"
        field_split => "|"
        target => "perf"
        source => "kvpairs"
      }

```

I get all required fields to Kibana as below

```
perf.Duration 2297
perf.Kernel 171
perf.User 1218
perf.type PerfExe

```

But all these fields are Strings.  
Im specifically interested to convert **"perf.Duration"** to an **integer**

I learned from Google that below thing is not gonna work

```
mutate {
            convert => { 
                "perf.Duration" => "integer"
                #"Duration" => "integer" <-- Earlier tried this to make sure i dont miss the correct field 
            }
          }

```

Then I tried few ruby filters as below

```
      ruby {
          code => 'event.set("perf.Duration", event.get("perf.Duration").to_i)'
      }

```

Then this

```
      ruby {
          code => "
            hash = event.to_hash
            hash.each { |key,value|
              if key == 'Duration' 
                event.set(value, value.to_i)
              end
            }
          "
      }

```

They didn't work as well.

Can someone help me to get this fixed please.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 23, 2019, 12:36am UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/2 "2019-08-23T00:36:20Z")

</div>

In Kibana, if a field is an object that contains another field it would appear as perf.Duration. In logstash, a field where the name contains a period would be perf.Duration, but a perf object that contains a Duration field would be called [perf][Duration]

Also in logstash, in the configuration \r and \n do not refer to CR and NL unless you have config.support\_escapes enables, but a lot of filters will just work around them, so you may not need to trim/strip them.

---

<div class="post-metadata">

### Author: ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [August 23, 2019, 4:58pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/3 "2019-08-23T16:58:47Z")

</div>

Thanks @Badger  
Below code did the trick

```
      ruby {
      code => 'event.set("[perf][Duration]", event.get("[perf][Duration]").to_i)'
      }

```

meanwhile i have another issue

when i have

```auto
source for kvpair: Duration: {2297} | Kernel: {171} | User: {1218}
and in a separate field
perf.type	PerfSproc

```

Im trying to do this

```
        if [perf.type] == "PerfSproc" { 
          mutate {
            rename => { "perf.Function" => "perf.Sproc"}
          } 
        }
        if [perf.type] == "PerfReplication" { 
          mutate {
            rename => { "perf.Function" => "perf.Sproc"}
          } 
        }
        if [perf.type] == "PerfExe" { 
          mutate {
            copy => { "hitachiprrogram" => "perf.exe"}
          } 
        }

```

And these does not work as expected  
cant i use mutate plugin at all in these cases?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 23, 2019, 5:56pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/4 "2019-08-23T17:56:33Z")

</div>

> [@Thanura\_Kannangara](#):
>
> rename =\> { "perf.Function" =\> "perf.Sproc"}

If [perf] is an object then these should be

```
rename => { "[perf][Function]" => "[perf][Sproc]"}

```

---

<div class="post-metadata">

### Author: ![Thanura\_Kannangara](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)
#### Post date: [August 23, 2019, 11:02pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/5 "2019-08-23T23:02:54Z")

</div>

Thanks @Badger 🤩🤩🤩

---

<div class="post-metadata">

### Author: ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [August 24, 2019, 4:27pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/6 "2019-08-24T16:27:01Z")

</div>

Badger is King of Logstash 💯

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 21, 2019, 4:27pm UTC](https://discuss.elastic.co/t/how-to-convert-kvpair-value-from-string-to-an-integer-in-logstash-pipeline/196421/7 "2019-09-21T16:27:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
