# Logstash filter (extractnumbers) install does not work
**URL:** https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073
**Category:** Logstash
**Created:** [December 5, 2016, 4:58pm UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073 "2016-12-05T16:58:55Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)
#### Post date: [December 5, 2016, 4:58pm UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/1 "2016-12-05T16:58:55Z")
Installed ELK 5.0.2 (Build 14476, Commit SHA 8f2ace74 ) on a clean server. Logstash is accepting data and elasticsearch is showing it's data. Now I want to make use of the config I already built in an older version. This needs the extractnumbers filter (logstash-filter-extractnumbers) for Logstash. Unfortunately, installing the filter is not as straightforward as the elastic doc page makes it seem... Did not find any other people having issues with this filter. Can somebody please have a look at this and solve it (seems the dependencies are wrong somewhere).
[root@ELK501 conf.d]# /usr/share/logstash/bin/logstash-plugin install logstash-filter-extractnumbers
Validating logstash-filter-extractnumbers
Installing logstash-filter-extractnumbers
Plugin version conflict, aborting
ERROR: Installation Aborted, message: Bundler could not find compatible versions for gem "logstash-core-plugin-api":
In snapshot (Gemfile.lock):
logstash-core-plugin-api (= 2.1.16)
In Gemfile:
logstash-devutils (~\> 1.1) java depends on
logstash-core-plugin-api (~\> 2.0) java
```
logstash-filter-extractnumbers (>= 0) java depends on
logstash-core-plugin-api (~> 1.0) java
logstash-core-plugin-api (>= 0) java
```
Running `bundle update` will rebuild your snapshot from scratch, using only
the gems in your Gemfile, which may resolve the conflict.
Bundler could not find compatible versions for gem "logstash-core":
In snapshot (Gemfile.lock):
logstash-core (= 5.0.2)
In Gemfile:
logstash-core-plugin-api (\>= 0) java depends on
logstash-core (= 5.0.2) java
```
logstash-filter-extractnumbers (>= 0) java depends on
logstash-core (< 2.0.0, >= 1.4.0) java
logstash-core (>= 0) java
```
Running `bundle update` will rebuild your snapshot from scratch, using only
the gems in your Gemfile, which may resolve the conflict.
Bundler could not find compatible versions for gem "logstash":
In Gemfile:
logstash-filter-extractnumbers (\>= 0) java depends on
logstash (\< 2.0.0, \>= 1.4.0) java
Could not find gem 'logstash (\< 2.0.0, \>= 1.4.0) java', which is required by gem 'logstash-filter-extractnumbers (\>= 0) java', in any of the sources.
---
### Author:  [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)
#### Post date: [December 5, 2016, 5:01pm UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/2 "2016-12-05T17:01:05Z")
Tried to run the update, which updated the "installed" plugins, but this did not have a positive effect on the installation of the Extractnumbers filter.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 5, 2016, 5:46pm UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/3 "2016-12-05T17:46:23Z")
The extractnumbers plugin isn't yet compatible with Logstash 5.0. See [pull request #2](https://github.com/logstash-plugins/logstash-filter-extractnumbers/pull/2).
---
### Author:  [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)
#### Post date: [December 6, 2016, 7:33am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/4 "2016-12-06T07:33:04Z")
Hello Magnus, thanks for your reply. Any news on the progress of the plugin update process ? It seems like this is quite a big and long-running process.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 6, 2016, 8:20am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/5 "2016-12-06T08:20:49Z")
> Any news on the progress of the plugin update process ? It seems like this is quite a big and long-running process.
I think all Elastic-supported plugins have been updated, but there are quite a few community-supported plugins, including extractnumbers, and you should set your expectations accordingly.
---
### Author:  [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)
#### Post date: [December 6, 2016, 8:33am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/6 "2016-12-06T08:33:59Z")
OK, thanks for the answer. Is there a way around Extractnumbers ? And will the documentation be updated with the fact that this filter does not work in 5.0 ? Currently the documentation states to just install the plugin, so I guess I won't be the only one having issues with non-working (community-supported) plugins.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 6, 2016, 8:37am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/7 "2016-12-06T08:37:12Z")
> Is there a way around Extractnumbers ?
Can't you use a grok filter?
> And will the documentation be updated with the fact that this filter does not work in 5.0 ?
I don't know if there are any such plans but I'll pitch it to the core team.
---
### Author:  [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)
#### Post date: [December 6, 2016, 8:44am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/8 "2016-12-06T08:44:00Z")
What I used is %{NUMBER:AVFileSize:int} but this does not seem to get put into Elasticsearch as I can't find the variable. Up till now it was quite easy just using the Extractnumber plugin as this did the trick for me in the "old" ELK environment.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 6, 2016, 8:44am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/9 "2016-12-06T08:44:38Z")
Without knowing what your events look like it's impossible to help.
---
### Author:  [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)
#### Post date: [December 6, 2016, 8:52am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/10 "2016-12-06T08:52:00Z")
The data is coming from a CSV file generated by an anti-virus script and it's in this format : /largefiles/Studio\_26/inbox/Sucker;Sucker\_Trailer\_1080p\_235\_LtRt.mxf;mxf;672183964;02/12/2016 20:44,
and I use this Logstash config :
filter {
if [type] == "avscanlog" {
grok {
match =\> { "message" =\> "%{PATH:Scanlocation};%{HTTPDUSER:Filename};%{HOSTNAME:File-extension};%{NUMBER:AVFilesize:int};%{JAVALOGMESSAGE:Scan\_timestamp}" }
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["Scan\_timestamp", "dd/MM/yyyy HH:mm", "MMM dd HH:mm"]
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 6, 2016, 10:02am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/11 "2016-12-06T10:02:57Z")
That grok expression doesn't make any sense. Why use HTTPDUSER for the second column? And HOSTNAME for a file extension? I suggest you use the csv filter instead. Use a mutate filter's convert option to make sure `AVFilesize` is an integer.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2017, 10:03am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073/12 "2017-01-03T10:03:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.