I have set up NUMBER type for item duration in the pattern of Logstash configuration as
%{NUMBER:Duration}
It can parse most of the numbers in the log files, like 9994568.872 , 20903.23, etc..
But it cannot parse the long numbers which contains letter 'E', like 1.1280996562E7
How shall I set the type of Duration? And I prefer to use number type. Do we have any replacement in Logstash?
Thanks,
Logstash is handling this field as a string by default. Have you tried converting the scientific notation field to a float using the mutate filter?
I believe that Elasticsearch is then able to automatically deal with scientific notation if it is sent in as not a string.
filter {
mutate {
convert => {
"duration" => "float"
}
}
}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.