# Logstash timetaken not recognized as an integer **URL:** \ **Category:** Logstash\ **Created:** [November 7, 2018, 5:22pm UTC](https://discuss.elastic.co/t/logstash-timetaken-not-recognized-as-an-integer/155765 "2018-11-07T17:22:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Daniel\_Carucha\_Altuz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_carucha_altuz/32/37387_2.png) [@Daniel\_Carucha\_Altuz](https://discuss.elastic.co/u/Daniel_Carucha_Altuz)\ **Post date:** [November 7, 2018, 5:22pm UTC](https://discuss.elastic.co/t/logstash-timetaken-not-recognized-as-an-integer/155765/1 "2018-11-07T17:22:47Z")
Hi, i have the next logline: 2018-11-07T13:48:26-03:00 localhost.localdomain haproxy[40370]: 10.5.38.210:55125 [07/Nov/2018:13:48:26.791] https-in~ default\_443/anseswww71.anses.gov.ar 101/0/1/83/185 200 604 - - ---- 335/325/4/1/0 0/0 "POST /autoconsultas/dondecobro.php HTTP/1.1" So i parse it using grok with this pattern %{SYSLOGLINE}%{IPV4:ip\_origen}:%{NUMBER:puerto:LONG} %{SYSLOG5424SD} %{URIHOST:FrontendName}~? %{WORD:Granja}/\? %{INT:TR}/%{NUMBER:TimeWaiting}/%{NUMBER:TimeToConnection}/%{NUMBER:ServerTimeResponse:INT}/%{NUMBER:TimeTaken:INT} %{NUMBER:Response} %{NUMBER:Bytesread:INT} - - %{DATA:SC}? %{NUMBER:ConcurrentConnectionsOnProcess:INT}/%{NUMBER:ConcurrentConnectionOnFrontend:INT}/%{NUMBER:ConcurrentConnectionOnBackend:INT}/%{NUMBER:ConnectionsOnServer:INT}/%{NUMBER:Retries:INT} %{WORD:aa}/%{WORD:aa} ("%{WORD:Method} %{URIPATHPARAM:Url} HTTP/1.1) My problem is that in kibana, i don't see "timetaken" as an integer... it keeps showing me timetaken as a string. Is there any way to convert it in logstash or in elastic? i need to get the average timetaken for my visualizations. Thanks! ---
**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\ **Post date:** [November 9, 2018, 7:41pm UTC](https://discuss.elastic.co/t/logstash-timetaken-not-recognized-as-an-integer/155765/2 "2018-11-09T19:41:11Z")
Are you defining a template when you are writing to elasticsearch? [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template) Although elasticsearch is generally pretty good at figure out which data type belongs where you may need to check that the template that gets created for your index and compare it to the data that you actually have. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2018, 7:41pm UTC](https://discuss.elastic.co/t/logstash-timetaken-not-recognized-as-an-integer/155765/3 "2018-12-07T19:41:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.