# Regex to integer\\float

**URL:** https://discuss.elastic.co/t/regex-to-integer-float/54333
**Category:** Logstash
**Created:** [June 29, 2016, 8:54pm UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333 "2016-06-29T20:54:53Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Boris\_Borshevsky](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Boris\_Borshevsky](https://discuss.elastic.co/u/Boris_Borshevsky)
#### Post date: [June 29, 2016, 8:54pm UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333/1 "2016-06-29T20:54:53Z")

</div>

Hi,  
I'm a little new to logstash.  
I'm trying to figure out if there is a way to convert fields that match specific regex to integer:  
i thought i could do it with grok but something there is not very clear to me.

use case:  
if field name starts with n\_ -\> convert value to integer  
if field name starts with f\_ -\> convert value to float  
else leave it as string

thanks in advance.

---

<div class="post-metadata">

### Author: ![noemie](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@noemie](https://discuss.elastic.co/u/noemie)
#### Post date: [June 30, 2016, 7:40am UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333/2 "2016-06-30T07:40:53Z")

</div>

Hello,

are the "n\_" and "f\_" sequences present anywhere else in your field names?

If not, you can just test if your field name contains one or the other sequence and then apply the mutate{ convert =\>... } to your fields. I should be possible, all that is required is the right condition for the if

Hope this will help

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 30, 2016, 8:48am UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333/3 "2016-06-30T08:48:38Z")

</div>

See this response from earlier this morning:

> [@Gsub specific characters but not all of them in value](https://discuss.elastic.co/t/gsub-specific-characters-but-not-all-of-them-in-value/53909/4):
>
> You'll have to use a ruby filter for that. Something similar to ruby { code =\> " event.to\_hash.each { |k, v| event[k] = v.to\_f if k.start\_with? 'metric-' } " } should work.

---

<div class="post-metadata">

### Author: ![Boris\_Borshevsky](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Boris\_Borshevsky](https://discuss.elastic.co/u/Boris_Borshevsky)
#### Post date: [July 3, 2016, 7:12am UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333/4 "2016-07-03T07:12:23Z")

</div>

Worked perfectly. thanks.

---

<div class="post-metadata">

### Author: ![poorbob](https://avatars.discourse-cdn.com/v4/letter/p/7c8e57/32.png) [@poorbob](https://discuss.elastic.co/u/poorbob)
#### Post date: [June 23, 2017, 5:25pm UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333/5 "2017-06-23T17:25:00Z")

</div>

Hey Boris, which route did you end up going with? I'm challenged with a similar situation

edit: the ruby filter will work well for this. However, as of logstash 5.x directly editing a fields value is not allowed. I instead had to do this:

```
event.set(k, v.to_f) if k.start_with? 'metric-'
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 4:23am UTC](https://discuss.elastic.co/t/regex-to-integer-float/54333/6 "2022-11-04T04:23:48Z")

</div>


