# How to get number from value field that is set as string and range it

**URL:** <https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046>\
**Category:** Elasticsearch\
**Created:** [December 2, 2018, 1:38pm UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046 "2018-12-02T13:38:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![assaf\_elgov](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@assaf\_elgov](https://discuss.elastic.co/u/assaf_elgov)\
**Post date:** [December 2, 2018, 1:38pm UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046/1 "2018-12-02T13:38:44Z")

</div>

Hi,

This is the content of one of the fields I get:

\*\*\*\*\* System health report \*\*\*\*\*  
Available processors (cores): 2  
Free memory: 63 MB  
Maximum memory: 247 MB  
Total memory: 247 MB  
Operating System Architecture: arm

all this data is in one big string, I want to create query to filter all the rows that has Free memory between 0 to 70.

Is it possible to do it without changing the original log?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 2, 2018, 3:29pm UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046/2 "2018-12-02T15:29:02Z")

</div>

You need to parse the log to create structured data from it. You can use an ingest pipeline with a grok processor to do that in elasticsearch.

---

<div class="post-metadata">

**Author:** ![assaf\_elgov](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@assaf\_elgov](https://discuss.elastic.co/u/assaf_elgov)\
**Post date:** [December 3, 2018, 6:33am UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046/3 "2018-12-03T06:33:27Z")

</div>

Thanks for the quick answer!  
Can you please provide with some simple example just for me to understand the idea.  
I looked into ingest as I had the feeling this is the way but I couldn't figure out how to do it.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 3, 2018, 8:12am UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046/4 "2018-12-03T08:12:18Z")

</div>

You have plenty of examples on internet, on this group, in the documentation.

For example this page [https://www.elastic.co/guide/en/elasticsearch/reference/6.5/grok-processor.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/grok-processor.html) shows an example of the simulate API you will need to adapt most likely to fit your use case. I started to adapt it for you:

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "health",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": ["%{GREEDYDATA:data}"]
      }
    }
  ]
},
"docs":[
  {
    "_source": {
      "message": "Available processors (cores): 2\nFree memory: 63 MB\nTotal memory: 247 MB\nOperating System Architecture: arm"
    }
  }
  ]
}

```

Start from this an try to find the right grok pattern which will work for you.  
The Grok Debugger in Kibana might help or this site: [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/)

---

<div class="post-metadata">

**Author:** ![assaf\_elgov](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@assaf\_elgov](https://discuss.elastic.co/u/assaf_elgov)\
**Post date:** [December 3, 2018, 10:06am UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046/5 "2018-12-03T10:06:44Z")

</div>

Thanks for the quick answer!  
I will try it out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2018, 10:06am UTC](https://discuss.elastic.co/t/how-to-get-number-from-value-field-that-is-set-as-string-and-range-it/159046/6 "2018-12-31T10:06:46Z")

</div>

Closed on December 31, 2018, 10:06am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.