# Which Filter to use

**URL:** <https://discuss.elastic.co/t/which-filter-to-use/177191>\
**Category:** Logstash\
**Created:** [April 17, 2019, 5:53am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191 "2019-04-17T05:53:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sjabiulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sjabiulla/32/48429_2.png) [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\
**Post date:** [April 17, 2019, 5:53am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191/1 "2019-04-17T05:53:34Z")

</div>

My log is something like below

{@timestamp} some text here key1=value1 key2=value2 key3=value3

I have tried json filter as below and got parsing errors. Which filter should I choose here ? I want to push all key value pairs and timestamp to variables in ElasticSearch.

```
json {
		source => "message"
	}
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 17, 2019, 6:00am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191/2 "2019-04-17T06:00:43Z")

</div>

As that log line is not JSON it is not surprising that the son filter does not work. I would recommend using a dissect or grok filter to parse the components of the string so that you end up with the final key-value list in a separate field. You can see how to go about doing this in [this introductory blog post](https://www.elastic.co/blog/a-practical-introduction-to-logstash).

You can then apply a kv filter to this field to parse the key-value pairs out.

---

<div class="post-metadata">

**Author:** ![sjabiulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sjabiulla/32/48429_2.png) [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\
**Post date:** [April 23, 2019, 8:32am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191/3 "2019-04-23T08:32:24Z")

</div>

@Christian_Dahlqvist  
I am using kv filter now as below. I have numbers as values in few of kv params, but in ElasticSearch they are being indexed as String's. How to index them as numbers !

```
      kv
		{ 
			source => "message" 
		} 

```

I have response time in log as below .  
`ResponseTimeMillis=454`  
But when it's indexed to ES, it's indexed as below.

`"ResponseTimeMillis": "454"`

I want it to be `"ResponseTimeMillis": 454`. Is it possible ?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 23, 2019, 8:33am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191/4 "2019-04-23T08:33:11Z")

</div>

Yes, add a mutate filter to convert to a number after you have parsed the data.

---

<div class="post-metadata">

**Author:** ![sjabiulla](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sjabiulla/32/48429_2.png) [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\
**Post date:** [April 23, 2019, 10:13am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191/5 "2019-04-23T10:13:11Z")

</div>

Awesome. I'm now able to use mutate filter to convert string to a Integer.

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2019, 10:13am UTC](https://discuss.elastic.co/t/which-filter-to-use/177191/6 "2019-05-21T10:13:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.