# Multiplication in logstash grok filter

**URL:** <https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875>\
**Category:** Logstash\
**Created:** [September 6, 2016, 11:01am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875 "2016-09-06T11:01:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Preeti\_Sharma](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@Preeti\_Sharma](https://discuss.elastic.co/u/Preeti_Sharma)\
**Post date:** [September 6, 2016, 11:01am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875/1 "2016-09-06T11:01:16Z")

</div>

I have following filter

```
filter {
  if [type] == "apache-access" {
    grok {
      match => { "message" => "%{APACHE}" }

        add_field => {
      "tym1" => "%{microseconds} * 0.000001"
                            }
}
}
}

```

Pattern is definded as

> APACHE %{COMBINEDAPACHELOG} \*\*%{NUMBER:seconds:int}/%{NUMBER:microseconds:int}

Its returning as

**234566\*0.000001**

in Kibana instead of

**0.234566**

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2016, 11:10am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875/2 "2016-09-06T11:10:52Z")

</div>

You need to use a ruby filter to perform the multiplication.

```nohighlight
ruby {
  code => "event['tym1'] = event['microseconds'].to_i * 0.000001"
}

```

---

<div class="post-metadata">

**Author:** ![Preeti\_Sharma](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@Preeti\_Sharma](https://discuss.elastic.co/u/Preeti_Sharma)\
**Post date:** [September 6, 2016, 11:13am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875/3 "2016-09-06T11:13:30Z")

</div>

Do I need to keep this in gork or if[type=apache] ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2016, 11:17am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875/4 "2016-09-06T11:17:38Z")

</div>

It assumes that there is a `microseconds` field so you may want to wrap it in a `if [microseconds] { ... }` conditional. Whether it's inside the `[type] == "apache"` conditional is up to you.

---

<div class="post-metadata">

**Author:** ![Preeti\_Sharma](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@Preeti\_Sharma](https://discuss.elastic.co/u/Preeti_Sharma)\
**Post date:** [September 6, 2016, 11:31am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875/5 "2016-09-06T11:31:49Z")

</div>

Thanks Magnus.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/multiplication-in-logstash-grok-filter/59875/6 "2017-07-06T04:39:41Z")

</div>