# Snippet q1

**URL:** <https://discuss.elastic.co/t/snippet-q1/141340>\
**Category:** Logstash\
**Created:** [July 24, 2018, 9:34am UTC](https://discuss.elastic.co/t/snippet-q1/141340 "2018-07-24T09:34:07Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 9:34am UTC](https://discuss.elastic.co/t/snippet-q1/141340/1 "2018-07-24T09:34:08Z")

</div>

what does this following snippet, especially the message line

grok  
{  
match =\>  
{ "message" =\> "CustomerID%{INT:CustomerID:int}  
"tag\_on\_failure" =\> []  
}

}

---

<div class="post-metadata">

**Author:** ![Charaf\_Ahmed](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charaf_ahmed/32/30467_2.png) [@Charaf\_Ahmed](https://discuss.elastic.co/u/Charaf_Ahmed)\
**Post date:** [July 24, 2018, 9:36am UTC](https://discuss.elastic.co/t/snippet-q1/141340/2 "2018-07-24T09:36:06Z")

</div>

I think this link could help you : [https://logz.io/blog/logstash-grok/](https://logz.io/blog/logstash-grok/)

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 24, 2018, 9:37am UTC](https://discuss.elastic.co/t/snippet-q1/141340/3 "2018-07-24T09:37:53Z")

</div>

[This link](https://www.elastic.co/blog/a-practical-introduction-to-logstash) may also be useful.

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:39am UTC](https://discuss.elastic.co/t/snippet-q1/141340/4 "2018-07-24T10:39:14Z")

</div>

In the link provided, there is no mentioned of data types like INT, int.

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:42am UTC](https://discuss.elastic.co/t/snippet-q1/141340/5 "2018-07-24T10:42:11Z")

</div>

this was useful. change of datatype in the single line

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:46am UTC](https://discuss.elastic.co/t/snippet-q1/141340/6 "2018-07-24T10:46:59Z")

</div>

:int is to change the datatype into integer. But what about the gork pattern INT? what does it stand for?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 24, 2018, 10:48am UTC](https://discuss.elastic.co/t/snippet-q1/141340/7 "2018-07-24T10:48:48Z")

</div>

Definitions can be found in [this GitHub repository](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns).

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:51am UTC](https://discuss.elastic.co/t/snippet-q1/141340/8 "2018-07-24T10:51:05Z")

</div>

got it . thanks.

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:52am UTC](https://discuss.elastic.co/t/snippet-q1/141340/9 "2018-07-24T10:52:33Z")

</div>

is there difference between INT and int?

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:52am UTC](https://discuss.elastic.co/t/snippet-q1/141340/10 "2018-07-24T10:52:58Z")

</div>

arent they one and the same?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 24, 2018, 10:53am UTC](https://discuss.elastic.co/t/snippet-q1/141340/11 "2018-07-24T10:53:47Z")

</div>

`INT` is the grok pattern that matches an integer. `int` is what you cast it to in the generated JSON document (but not necessarily how it is mapped in Elasticsearch).

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:55am UTC](https://discuss.elastic.co/t/snippet-q1/141340/12 "2018-07-24T10:55:37Z")

</div>

Got it. In other words, if i do not typecast into int, What would be the default data type of the grok pattern. Is it a string?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 24, 2018, 10:56am UTC](https://discuss.elastic.co/t/snippet-q1/141340/13 "2018-07-24T10:56:11Z")

</div>

Yes.

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [July 24, 2018, 10:58am UTC](https://discuss.elastic.co/t/snippet-q1/141340/14 "2018-07-24T10:58:24Z")

</div>

got it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2018, 10:58am UTC](https://discuss.elastic.co/t/snippet-q1/141340/15 "2018-08-21T10:58:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.