Kibana show field as string in "Table" view and as number in "JSON" view

Elastic Stack Kibana
1

I parse my log with grok. Some fields parsed to number with the grok format {BASE10NUM:DB_time:int}.
When I look on the data in Kibana (version 7.6) I see something that looks like bug.
In "Table" view the DB_time field is string:

table view
While in the "JSON" view is a number:

json view

Is it a bug in Kibana or maybe I missed something?

2

Anyone else saw such issue?
Should I report about bug on Kibana's github?

3

It's not a bug.you need to define your field as number.

4

As I wrote, I defined it in grok to make it number "int". And it is actually number and I can see it in the JSON view as you can see in my first post. The problem is that it is presented as string in Table view.
In addition, Kibana don't give me this field in the list of all fields from type number when I'm trying to build visualization.

5

Does it show as text/keyword or number in the index template? Kibana reads from there, so if it got set as text, that's how Kibana will use it. Did you use the grok filter in Logstash or the file upload to parse your log file?

6

You are right!!!
The index pattern show these fields as text. This was the root cause of this strange behavior.
The reason that the index pattern show it as text is because I created the pattern before I fixed the parser to parse the fields as number.
I deleted the pattern and create new one and now it works correctly.
Thank you very much!

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.