A custom script produces a json message and is logged into my new Graylog instance, but its numeric fields are being interpreted as String and are therefore treated and stored as String. Consequently, I cannot Chart against these values. Ex. Message: {"level": "6", "details": {"memorypercent": "0…

Ok pipeline field rewrite rule is not necessary in my case, because indeed Graylog/Elasticsearch does treat a numeric json value as numeric on store, provided the original value seen is numeric to begin with, and I can do numeric operations on them like Generate Chart. I’ll have to rewrite all my j…

Use Pipeline rules to convert them to to numeric using to_double function.

Is this really necessary? If json presents the data as numeric, Graylog can’t just know it’s numeric? … and do I really have to do this for all json extracted fields I wish to be treated as numeric? I did create a pipeline rule to convert using to_double as suggested, but it doesn’t seem to resol…

just as addition, you can force field type using a template, a custom mapping http://docs.graylog.org/en/2.3/pages/configuration/elasticsearch.html#custom-index-mappings That way you do not count on the way elasticsearch recognize the values and if the first message by accident has a string charac…

Excellent tip - thanks @jan . I have at least one field coming from apache json that is a valid user id 90% of the time (Long) but sometimes “-” when not set by the application. Will Graylog crap out on “-” and not process the entire message, the field, or …?

Hej @texas-bronius , it will - as currently already - if the message content did not fit into the field message type. But if you have such known fields, you might want to check those fields/messages in a pipeline and remove those fields not matching the configured/wanted field type. Just to have th…

Sorry to be dense here (and I am also still looking online for clarification): If a field is known to be, say, Long, and message processor encounters a String like “-”, will the field be set to some empty value, will the field be discarded, or will the whole message get discarded? And when this hap…

I’m glad that you find the answer before I was able to jump in - and shared it! You earn a double star for that! thank you for the active work in the community!

Changing a field type from string to numeric and mid-setup and past string values

Graylog Central (peer support)

Topic		Replies	Views
Problem with numeric field created by JSON extractor Graylog Central (peer support)	4	2520	June 21, 2017
Forcing numeric fields Graylog Central (peer support)	7	7505	May 4, 2017
Unexpected behavior for handling numeric field Graylog Central (peer support)	5	503	January 21, 2019
Pipeline Rule - converted numbers changed to zeros Graylog Central (peer support) pipeline-rules , debuggingpl , sidecar , nxlog , nodatanx	24	3495	September 7, 2023
Pipeline help convert field numeric field Graylog Central (peer support) pipeline-rules	2	3738	June 23, 2020

Changing a field type from string to numeric and mid-setup and past string values

Related topics