# Logstash configurtaion for convert to Number

**URL:** <https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194>\
**Category:** Logstash\
**Created:** [July 16, 2024, 6:20am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194 "2024-07-16T06:20:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [July 16, 2024, 6:20am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194/1 "2024-07-16T06:20:51Z")

</div>

Hi , We are trying a configuration to convert the message field (which has number coming as Text) to integer as we have to create some line graphs based on the number .

We tried below configuration but its converting only first digit.  
ex: if message field has "1234"after conversion its showing only 1 .  
Kindly suggest any ideas.

```auto
input {
  beats {
    port => 5046
    ecs_compatibility => "v8"
    include_codec_tag => false
    }
}
filter {
        grok {
        match => { "message" => "%{NUMBER:count}" }
        }
        mutate {
        convert => { "count" => "integer" }
        }
}

```

---

<div class="post-metadata">

**Author:** ![NgDinhNamEtiis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ngdinhnametiis/32/135683_2.png) [@NgDinhNamEtiis](https://discuss.elastic.co/u/NgDinhNamEtiis)\
**Post date:** [July 16, 2024, 8:19am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194/2 "2024-07-16T08:19:49Z")

</div>

I can say that the problem is not from the filter as I running from my local machine, it look like it run as you expected:

```auto
{
  "@version": "1",
  "@timestamp": "2024-07-16T07:58:46.730900926Z",
  "message": "12345678912348",
  "count": 12345678912348,
  "event": {
    "original": "12345678912348"
  }
}

```

You should check for the input message or the event.original.

---

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [July 16, 2024, 8:36am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194/3 "2024-07-16T08:36:44Z")

</div>

Hi ,

We are getting the output like this :

Here you can see Table view - Count is truncated or converted only first digit and and event.original is in text form.  
Json view - Unicode is coming for event.original and count is coming as single digit .

![image](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ff50cafbf02f27975546e21fd5df27263b1f5ee6.png)

```auto
"event": {
      "original": "\u00006\u00006\u00007\u00000\u00008\u0000\r\u0000"
    },

```

---

<div class="post-metadata">

**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\
**Post date:** [July 16, 2024, 8:49am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194/4 "2024-07-16T08:49:01Z")

</div>

Hi,

You can try using the `gsub` function in the `mutate` filter to remove these non-printable characters before applying the grok pattern. Here's how you can modify your configuration:

```auto
filter {
    mutate {
        gsub => ["message", "[\x00-\x1F]", ""]
    }

```

Regards

---

<div class="post-metadata">

**Author:** ![NgDinhNamEtiis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ngdinhnametiis/32/135683_2.png) [@NgDinhNamEtiis](https://discuss.elastic.co/u/NgDinhNamEtiis)\
**Post date:** [July 16, 2024, 9:50am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194/5 "2024-07-16T09:50:06Z")

</div>

Should try use other regex form, like BASE16NUM or BASE16FLOAT rather then NUMBER.

```auto
        grok {
        match => { "message" => "%{NUMBER:count}" }
        }

```

Here is the link for more infor about them: [logstash-patterns-core/patterns/ecs-v1/grok-patterns at main · logstash-plugins/logstash-patterns-core (github.com)](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/grok-patterns)

---

<div class="post-metadata">

**Author:** ![Shalinicts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shalinicts/32/81251_2.png) [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Post date:** [July 16, 2024, 10:30am UTC](https://discuss.elastic.co/t/logstash-configurtaion-for-convert-to-number/363194/6 "2024-07-16T10:30:28Z")

</div>

Hi ,

Its getting converted after trying below code:

```auto
mutate {
        gsub => ["message", "[\x00-\x1F]", ""]
        }
        grok {
        match => { "message" => "%{BASE16NUM:count}" }
        }
        mutate {
        convert => { "count" => "integer" }
        }

```

Thanks for your help!