# Unable to Grok scientific notation numbers using ingest pipelines

**URL:** https://discuss.elastic.co/t/unable-to-grok-scientific-notation-numbers-using-ingest-pipelines/131440
**Category:** Elasticsearch
**Created:** [May 11, 2018, 8:55am UTC](https://discuss.elastic.co/t/unable-to-grok-scientific-notation-numbers-using-ingest-pipelines/131440 "2018-05-11T08:55:20Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![remaselvi](https://avatars.discourse-cdn.com/v4/letter/r/a3d4f5/32.png) [@remaselvi](https://discuss.elastic.co/u/remaselvi)
#### Post date: [May 11, 2018, 8:55am UTC](https://discuss.elastic.co/t/unable-to-grok-scientific-notation-numbers-using-ingest-pipelines/131440/1 "2018-05-11T08:55:20Z")

</div>

Hi there,

I'm having the following issue with the Grok Processor in ingest pipeline as defined:

```auto
PUT _ingest/pipeline/number-pipe
{
  "processors" : [
    {
      "grok": {
        "field": "message",
        "patterns": [
			"number: %{NUMBER:test-number}"
        ]
      }
    }
  ]
}

```

Running the following \_simulate:

```auto
POST _ingest/pipeline/number-pipe/_simulate
{
  "docs" : [
    {
      "_source": {
        "message": "number: 1.234e12"
      }
    }
  ]
}

```

Result:

```auto
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_type": "_type",
        "_id": "_id",
        "_source": {
          "message": "number: 1.234e12",
          "test-number": "1.234"
        },
        "_ingest": {
          "timestamp": "2018-05-11T08:52:24.693Z"
        }
      }
    }
  ]
}

```

Am I doing the right thing using `NUMBER` as a grok pattern ?

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2018, 5:03am UTC](https://discuss.elastic.co/t/unable-to-grok-scientific-notation-numbers-using-ingest-pipelines/131440/3 "2018-06-12T05:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.