How to get Number type by using Grok

Elastic Stack Logstash
1

Hi,

I have this field below
image
and I want to use grok to get the number 427 at the end and add it to new field as type number

I did the following
grok {
match => { "name" => "%{GREEDYDATA}device: %{NUMBER:concurrentUsers}"}
}

but still get the new field named concurrentUsers as string concurrentUsers
image

How can I make Number type??

2

Quoting the grok filter documentation:

Optionally you can add a data type conversion to your grok pattern. By default all semantics are saved as strings. If you wish to convert a semantic’s data type, for example change a string to an integer then suffix it with the target data type. For example %{NUMBER:num:int} which converts the num semantic from a string to an integer. Currently the only supported conversions are int and float .

Keep in mind that the data type of a field in an index can't ever change, so you have to reindex your current data or just start over.

3 Likes
3

I did the change in conf file with %{NUMBER:concurrentUsers:int} and still the field string cause I think the index in elasticsearch is mentioning string datatype. How can I reindex the data?

4

I created new index and removed the old one and now its working successfully
thank you

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.