Failed to parse field of type [float]

Hi there!
First of all, excuse my english.

The raw message from nginx:

somehost nginx: 31.33.81.29 | 192.168.1.3:7777 | 28/Jul/2019:20:28:44 +0300 | POST /v1/edited.set HTTP/2.0 | 200 | 200 | RU | 0.027 | 0.028 | somehost.android/1.12.1 (Redmi 5 Plus; Android 7.1.2) | - | https | ge67a7k7keps931rqglok1i3123a4o | -

There is we see value “0.028” - it’s $upstream_response_time .
Sometimes this field has value “-”.
I need to convert $upstream_response_time value to numeric. To avoid errors in /var/log/elasticsearch/graylog.log, I wrote a condition:

  • Only attempt extraction if field matches regular expression - \d+\.\d\d\d

But anyway I have a lot of errors like this:

org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [b_time] of type [float] in document with id ‘b8b3bce1-b15e-11e9-a11a-002590a78074’
Caused by: java.lang.NumberFormatException: For input string: “-”

Regular expression above doesn’t include value “-”, why extractor tried to proceed this message?
Could somebody help me? It is a bug or i did something wrong?

Screenshot_20190728_204752

Hello :slight_smile:
Could you post the very same info but with message that has “-” string instead of actual FLOAT values?
I mean: the whole message + Extractor configuration for that message with “Field matches regular expression” already tried.

It would be great if we could compare those 2 situations you described 1-1 :slight_smile:

My bet is: Your regex will always match against your field because you have some other float values in it. From my understanding this regex is matching against all of the source field, you would have to:

  1. Copy the part that you are interested in, save it as a STRING (so without any parsers). You can use the current extractor but remove the regex matching condition and NUMERIC parser.
  2. Create another extractor on that newly created field which will now contain only one float value or “-” string. This extractor should look exactly as the one you have right now - it will match against whole field but your field now contains only the part you are interested in so it will work correctly. Because it is now matching correctly you can use the NUMERIC parser in this extractor.

Hi!
You’re right.
Today I’ve resolved this issue with method that you wrote.
I thought that when i create an extractor, Graylog just copies value into new field and reg exp doesn’t affect source message.

It’s really weird and not obviously.

Thank you for your response.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.