Snippet q1

Elastic Stack Logstash
1

what does this following snippet, especially the message line

grok
{
match =>
{ "message" => "CustomerID%{INT:CustomerID:int}
"tag_on_failure" => []
}

}

2

I think this link could help you : https://logz.io/blog/logstash-grok/

3

This link may also be useful.

1 Like
4

In the link provided, there is no mentioned of data types like INT, int.

5

this was useful. change of datatype in the single line

6

:int is to change the datatype into integer. But what about the gork pattern INT? what does it stand for?

7

Definitions can be found in this GitHub repository.

8

got it . thanks.

9

is there difference between INT and int?

10

arent they one and the same?

11

INT is the grok pattern that matches an integer. int is what you cast it to in the generated JSON document (but not necessarily how it is mapped in Elasticsearch).

12

Got it. In other words, if i do not typecast into int, What would be the default data type of the grok pattern. Is it a string?

13

Yes.

14

got it

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.