# Logstash dissect convert\_datatype
**URL:** https://discuss.elastic.co/t/logstash-dissect-convert-datatype/96017
**Category:** Logstash
**Created:** [August 6, 2017, 1:16pm UTC](https://discuss.elastic.co/t/logstash-dissect-convert-datatype/96017 "2017-08-06T13:16:00Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)
#### Post date: [August 6, 2017, 1:16pm UTC](https://discuss.elastic.co/t/logstash-dissect-convert-datatype/96017/1 "2017-08-06T13:16:00Z")
**大家好：**
我使用logstash的dissect插件进行nginx日志的字段切割，然后用convert\_datatype进行日志字段数据类型转换，但是有个问题，request\_time和upstream\_response\_time字段有时候并不一定是浮点类型，有时候却是'-'字符来代替，因此用convert\_datatype来将这两个字段转换成float类型时会抛异常，然后将这两个字段的值设置为原先的字符串，即'-'。我想要的结果是当这两个字段是'-'导致数据类型转换失败时，给这两个字段一个默认的数值，即0.00而不是给一个字符串'-'。
**以下是运行logstash后抛出的异常（配置文件及示例日志见后面）：**
> [2017-08-05T22:28:29,551][WARN][logstash.filters.dissect] Dissector datatype conversion, value cannot be coerced, key: request\_time, value: - [2017-08-05T22:28:29,551][WARN][logstash.filters.dissect] Dissector datatype conversion, value cannot be coerced, key: upstream\_response\_time, value: -
**以下是我的nginx日志格式：**
> $time\_local|server\_ip|$request | $status | $remote\_user | $remote\_addr | $http\_user\_agent | $http\_referer | $host | $bytes\_sent|$request\_time|$upstream\_response\_time|$upstream\_addr|$connection|$connection\_requests|$uuid
**示例日志（注意request\_time和upstream\_response\_time字段的值是'-'，不是数值类型）：**
> 05/Aug/2017:22:22:33 -0700|54.153.101.30|GET /listing/detail/1864252/MO/St-Louis/www HTTP/1.1|200|-|5.255.250.132|Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)|-|env1-2.chime.me|76627|-|-|127.0.0.1:10300|4483145|2|38873227-aa0e-412b-b93f-13a7d0e26fb7
**Logstash 配置文件：**
> input {
> beats {
> port =\> 5044
> }
> }
> filter {
> ruby {
> code =\> "
> event.timestamp.time.localtime
> tstamp = event.get('@timestamp').to\_i
> Time.at(tstamp).strftime('%Y-%m-%d')
> "
> }
> dissect {
> mapping =\> {
> "message" =\> "%{time\_local}|%{server\_ip}|%{request}|%{status\_code}|%{remote\_user}|%{remote\_addr}|%{http\_user\_agent}|%{http\_referer}|%{host}|%{bytes\_sent}|%{request\_time}|%{upstream\_response\_time}|%{upstream\_addr}|%{connection}|%{connection\_requests}|%{uuid}"
> }
> convert\_datatype =\> {
> status\_code =\> "int"
> bytes\_sent =\> "int"
> request\_time =\> "float"
> upstream\_response\_time =\> "float"
> }
> }
> }
> output {
> if [business] == "nginx" and [type] == "access" {
> stdout { codec =\> rubydebug }
> }
> }
**当以上面的配置文件运行logstash后得到的结果如下：**
> {
> "request" =\> "GET /listing/detail/1864252/MO/St-Louis/www HTTP/1.1",
> "status\_code" =\> 200,
> "upstream\_addr" =\> "127.0.0.1:10300",
> "connection\_requests" =\> "2",
> "source" =\> "/home/ec2-user/nginx/logs/access.log",
> "type" =\> "access",
> "uuid" =\> "38873227-aa0e-412b-b93f-13a7d0e26fb7",
> "http\_user\_agent" =\> "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)",
> "remote\_user" =\> "-",
> "request\_time" =\> "-",
> "@version" =\> "1",
> "beat" =\> {
> "hostname" =\> "[awsuw7-50.opi.com](http://awsuw7-50.opi.com)",
> "name" =\> "[awsuw7-50.opi.com](http://awsuw7-50.opi.com)",
> "version" =\> "5.5.1"
> },
> "host" =\> "[env1-2.chime.me](http://env1-2.chime.me)",
> "server\_ip" =\> "54.153.101.30",
> "connection" =\> "4483145",
> "remote\_addr" =\> "5.255.250.132",
> "offset" =\> 270,
> "business" =\> "nginx",
> "input\_type" =\> "log",
> "time\_local" =\> "05/Aug/2017:22:22:33 -0700",
> "message" =\> "05/Aug/2017:22:22:33 -0700|54.153.101.30|GET /listing/detail/1864252/MO/St-Louis/www HTTP/1.1|200|-|5.255.250.132|Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)|-|env1-2.chime.me|76627|-|-|127.0.0.1:10300|4483145|2|38873227-aa0e-412b-b93f-13a7d0e26fb7",
> "bytes\_sent" =\> 76627,
> "tags" =\> [
> [0] "beats\_input\_codec\_plain\_applied",
> [1] "\_dataconversionuncoercible\_request\_time\_float",
> [2] "\_dataconversionuncoercible\_upstream\_response\_time\_float"
> ],
> "@timestamp" =\> 2017-08-06T05:28:24.508Z,
> "http\_referer" =\> "-",
> "upstream\_response\_time" =\> "-"
> }
可以发现request\_time和upstream\_response\_time是原先的'-'字符串，这并不是我想要的，我想在转换失败时给一个默认的数值，比如0.00，而不是字符串。
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 3, 2017, 1:16pm UTC](https://discuss.elastic.co/t/logstash-dissect-convert-datatype/96017/2 "2017-09-03T13:16:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.