Using Ingest to parse a double value

[sandsbl]

I am relatively new to Elasticsearch. I am using Ingest node processors to parse incoming log entries sent from other servers using Filebeat. There are values within the log entries that I want to parse as double precision numbers but the grok and convert processors seem to be limited to float precision.

What is the best way to handle double values parsed from string log entries?

[thiago (Thiago Souza)]

You should use grok to extract the double value into a field. Grok won't parse it into a number at all, it will simply extract the pattern and store it into a field, as a string. Then you just leave it as a string field and do not try to convert it (because indeed the convert processor is limited to float precision). Lastly, make sure you map the field in Elasticsearch as double type and, even though it's a string field in the source, Elasticsearch will handle it as a numeric field for searching and aggregations.

Hope that helps