Out put type as "float" instead of "String"

Elastic Stack Logstash
1

I am looking for output with "User" and "Nice" parameters as float. I am getting as "String" because of "%" I guess. Any suggestions appreciated.

$ ./logstash -e 'input { stdin { } } filter { grok { match => [ "message", "%{NUMBER:[CPU]User%:float} %{NUMBER:[CPU]Nice%:float}" ] } }'
Logstash startup completed
44.3 2.34
{
"message" => "44.3 2.34",
"@version" => "1",
"@timestamp" => "2015-11-25T00:23:55.252Z",
"host" => "lcam88",
"CPU" => {
"User" => "44.3",
"Nice" => "2.34"
}
}

2

The official syntax for subfields is [field][subfield]. It seems [field]subfield works but I wouldn't rely on it. This could actually be the reason why your configuration doesn't work.

If not, what if you drop % in the grok expression and rename the field afterwards?

3

Yes your approach helped, Magnus.
Thanks