# Long and float fields showing up as text fields in Kibana

**URL:** <https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921>\
**Category:** Logstash\
**Created:** [February 10, 2021, 6:37pm UTC](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921 "2021-02-10T18:37:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![asnyameeteen](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@asnyameeteen](https://discuss.elastic.co/u/asnyameeteen)\
**Post date:** [February 10, 2021, 6:37pm UTC](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921/1 "2021-02-10T18:37:49Z")

</div>

Running Kibana version 5.5.2.  
My current setup is Logstash is taking the logs from Docker containers, runs grok filters before sending the logs to elasticsearch. The specific logs that I need to show up as long, float are two times from AWS calls to ECS and EC2 and currently a grok filter pulls them out. Here is the custom filter that pulls out the ECS timings: `ECS_DESCRIBE_CONTAINER_INSTANCES (AWS)(%{SPACE})(ecs)(%{SPACE})(%{POSINT})(%{SPACE})(?<ECS_DURATION>(%{NUMBER}))(s)(%{SPACE})(?<ECS_RETRIES>(%{NONNEGINT}))(%{SPACE})(retries)` so I need ECS\_DURATION to be a float and ECS\_RETRIES to be a long. In the docker log handler I have the following

```auto
    if [ECS_DURATION] {
      mutate {
        convert => ["ECS_DURATION", "float"]
      }
    }

    if [ECS_RETRIES] {
      mutate {
        convert => ["ECS_RETRIES", "integer"]
      }
    }

```

When I look at the field in Kibana, it still shows as a text field, but when I make the following request to elasticsearch for the mappings, it shows those fields as long and float.

```auto
GET /logstash-2020.12.18/_mapping
{
  "logstash-2020.12.18": {
    "mappings": {
      "log": {
        "_all": {
          "enabled": true,
          "norms": false
        },
        "dynamic_templates": [
          {
            "message_field": {
              "path_match": "message",
              "match_mapping_type": "string",
              "mapping": {
                "norms": false,
                "type": "text"
              }
            }
          },
          {
            "string_fields": {
              "match": "*",
              "match_mapping_type": "string",
              "mapping": {
                "fields": {
                  "keyword": {
                    "ignore_above": 256,
                    "type": "keyword"
                  }
                },
                "norms": false,
                "type": "text"
              }
            }
          }
        ],
        "properties": {
          "@timestamp": {
            "type": "date",
            "include_in_all": false
          },
          "@version": {
            "type": "keyword",
            "include_in_all": false
          },
          "EC2_DURATION": {
            "type": "float"
          },
          "EC2_RETRIES": {
            "type": "long"
          },
          "ECS_DURATION": {
            "type": "float"
          },
          "ECS_RETRIES": {
            "type": "long"
          },

```

I even created a custom mapping template in elasticsearch with the following call

```auto
PUT /_template/aws_durations?pretty
{
  "template": "logstash*",
  "mappings": {
    "type1": {
      "_source": {
        "enabled": true
      },
      "properties": {
        "ECS_DURATION": {
          "type": "half_float"
        },
        "ECS_RETRIES": {
          "type": "byte"
        },
        "EC2_DURATION": {
          "type": "half_float"
        },
        "EC2_RETRIES": {
          "type": "byte"
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2021, 6:38pm UTC](https://discuss.elastic.co/t/long-and-float-fields-showing-up-as-text-fields-in-kibana/263921/2 "2021-03-10T18:38:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.