CISCO ASA Severity Level

[derPhlipsi (Philipp Ruland)]

Well, that’s strange that the to_long() function turns a 4 to 0. This normally indicates a formatting exeption.

Doing a quick search I found this:

Graylog pipeline problem

Joechen, Sorry about that. If i change to_double to to_long, look like the above reply. The bandwidth_kb will be 0 for all case. when has_field(“spendtime”) then let time = to_double($message.spendtime); let size = to_double($message.bytes); let bandwidth = size / time ; let bandwidth_kb = to_long(bandwidth / 1024.0); set_field(“speed_bytes_sec”, bandwidth); set_field(“speed_kb_sec”, bandwidth_kb); end speed_bytes_sec 67548.1865284974 speed_kb_sec 0

Which Graylog version are you running? to_long() returning zero is a bug prior to Graylog 2.4.0

Greetings,
Philipp