# In dissect plugin, use convert\_datatype to convert data type
**URL:** https://discuss.elastic.co/t/in-dissect-plugin-use-convert-datatype-to-convert-data-type/96015
**Category:** Logstash
**Created:** [August 6, 2017, 10:59am UTC](https://discuss.elastic.co/t/in-dissect-plugin-use-convert-datatype-to-convert-data-type/96015 "2017-08-06T10:59:07Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)
#### Post date: [August 6, 2017, 10:59am UTC](https://discuss.elastic.co/t/in-dissect-plugin-use-convert-datatype-to-convert-data-type/96015/1 "2017-08-06T10:59:07Z")
**Hello, everyone!**
I logstash, i use dissect plugin to split nginx log, then use convert\_datatype to convert filed data type. But in my nginx log, the request\_time and upstream\_response\_time fields will be '-' sometimes, not only the float type. So when i use convert\_datatype to convert these to fields the logstash will throw the following exception, and then logstash will give the string value(the original string '-') to the request\_time and upstream\_response\_time fields, **what i want is that when convert data type failed, give these two fields a default number value such as 0.000 not '-'(a string value)**:
> [2017-08-05T22:28:29,551][WARN][logstash.filters.dissect] Dissector datatype conversion, value cannot be coerced, key: request\_time, value: -
> [2017-08-05T22:28:29,551][WARN][logstash.filters.dissect] Dissector datatype conversion, value cannot be coerced, key: upstream\_response\_time, value: -
**My nginx log format:**
> %{time\_local}|%{server\_ip}|%{request}|%{status\_code}|%{remote\_user}|%{remote\_addr}|%{http\_user\_agent}|%{http\_referer}|%{host}|%{bytes\_sent}|%{request\_time}|%{upstream\_response\_time}|%{upstream\_addr}|%{connection}|%{connection\_requests}|%{uuid}
**An example log(Take care the request\_time and upstream\_response\_time fields are '-'):**
> 05/Aug/2017:22:22:33 -0700|54.153.101.30|GET /listing/detail/1864252/MO/St-Louis/www HTTP/1.1|200|-|5.255.250.132|Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)|-|env1-2.chime.me|76627|-|-|127.0.0.1:10300|4483145|2|38873227-aa0e-412b-b93f-13a7d0e26fb7
**My logstash config(just debug)**:
> input {
> beats {
> port =\> 5044
> }
> }
> filter {
> ruby {
> code =\> "
> event.timestamp.time.localtime
> tstamp = event.get('@timestamp').to\_i
> Time.at(tstamp).strftime('%Y-%m-%d')
> "
> }
> dissect {
> mapping =\> {
> "message" =\> "%{time\_local}|%{server\_ip}|%{request}|%{status\_code}|%{remote\_user}|%{remote\_addr}|%{http\_user\_agent}|%{http\_referer}|%{host}|%{bytes\_sent}|%{request\_time}|%{upstream\_response\_time}|%{upstream\_addr}|%{connection}|%{connection\_requests}|%{uuid}"
> }
> convert\_datatype =\> {
> status\_code =\> "int"
> bytes\_sent =\> "int"
> request\_time =\> "float"
> upstream\_response\_time =\> "float"
> }
> }
> }
> output {
> if [business] == "nginx" and [type] == "access" {
> stdout { codec =\> rubydebug }
> }
> }
So, when i run logstash with above config, the result i get as following( **the request\_time and upstream\_response\_time fields are string value not number** ):
> {
> "request" =\> "GET /listing/detail/1864252/MO/St-Louis/www HTTP/1.1",
> "status\_code" =\> 200,
> "upstream\_addr" =\> "127.0.0.1:10300",
> "connection\_requests" =\> "2",
> "source" =\> "/home/ec2-user/nginx/logs/access.log",
> "type" =\> "access",
> "uuid" =\> "38873227-aa0e-412b-b93f-13a7d0e26fb7",
> "http\_user\_agent" =\> "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)",
> "remote\_user" =\> "-",
> "request\_time" =\> "-",
> "@version" =\> "1",
> "beat" =\> {
> "hostname" =\> "[awsuw7-50.opi.com](http://awsuw7-50.opi.com)",
> "name" =\> "[awsuw7-50.opi.com](http://awsuw7-50.opi.com)",
> "version" =\> "5.5.1"
> },
> "host" =\> "[env1-2.chime.me](http://env1-2.chime.me)",
> "server\_ip" =\> "54.153.101.30",
> "connection" =\> "4483145",
> "remote\_addr" =\> "5.255.250.132",
> "offset" =\> 270,
> "business" =\> "nginx",
> "input\_type" =\> "log",
> "time\_local" =\> "05/Aug/2017:22:22:33 -0700",
> "message" =\> "05/Aug/2017:22:22:33 -0700|54.153.101.30|GET /listing/detail/1864252/MO/St-Louis/www HTTP/1.1|200|-|5.255.250.132|Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)|-|env1-2.chime.me|76627|-|-|127.0.0.1:10300|4483145|2|38873227-aa0e-412b-b93f-13a7d0e26fb7",
> "bytes\_sent" =\> 76627,
> "tags" =\> [
> [0] "beats\_input\_codec\_plain\_applied",
> [1] "\_dataconversionuncoercible\_request\_time\_float",
> [2] "\_dataconversionuncoercible\_upstream\_response\_time\_float"
> ],
> "@timestamp" =\> 2017-08-06T05:28:24.508Z,
> "http\_referer" =\> "-",
> "upstream\_response\_time" =\> "-"
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2017, 10:59am UTC](https://discuss.elastic.co/t/in-dissect-plugin-use-convert-datatype-to-convert-data-type/96015/2 "2017-09-03T10:59:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.