# Field statistics/chart on extracted number showing NAN?

**URL:** <https://community.graylog.org/t/field-statistics-chart-on-extracted-number-showing-nan/5494>\
**Category:** Graylog Central (peer support)\
**Created:** [June 6, 2018, 1:12pm UTC](https://community.graylog.org/t/field-statistics-chart-on-extracted-number-showing-nan/5494 "2018-06-06T13:12:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![uclnj](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@uclnj](https://community.graylog.org/u/uclnj)\
**Post date:** [June 6, 2018, 1:12pm UTC](https://community.graylog.org/t/field-statistics-chart-on-extracted-number-showing-nan/5494/1 "2018-06-06T13:12:16Z")

</div>

I created a regex extractor against a firewall syslog message similar to this string smtp-proxy[2155]: msg\_id=“1BFF-000F” Allow rcvd\_bytes=“7885” sent\_bytes=“6333” and when I search for the msg\_id, the expanded message shows smtp\_rcvd\_bytes: 7885.

The extractor includes the conversion to numeric at the bottom yet when I bring up the field statistics for smtp\_rcvd\_bytes I only get the count - all fields except for cardinality show NAN so I can’t graph this value either.

This is what the extractor shows:

Condition  
Will only attempt to run if the message includes the string msg\_id=“1BFF-000F”  
Configuration  
regex\_value: rcvd\_bytes="([0-9]+)"  
Converters  
numeric

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 6, 2018, 2:38pm UTC](https://community.graylog.org/t/field-statistics-chart-on-extracted-number-showing-nan/5494/2 "2018-06-06T14:38:47Z")

</div>

> [@uclnj](#):
>
> The extractor includes the conversion to numeric at the bottom yet when I bring up the field statistics for smtp\_rcvd\_bytes I only get the count - all fields except for cardinality show NAN so I can’t graph this value either.

Make sure that the message fields you want to analyze are numeric over the complete time range of the query.

You can create a custom index template to enforce a data type:  
[http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings)

---

<div class="post-metadata">

**Author:** ![uclnj](https://avatars.discourse-cdn.com/v4/letter/u/e480ec/32.png) [@uclnj](https://community.graylog.org/u/uclnj)\
**Post date:** [June 6, 2018, 6:33pm UTC](https://community.graylog.org/t/field-statistics-chart-on-extracted-number-showing-nan/5494/3 "2018-06-06T18:33:40Z")

</div>

it was the timeframe, some of the results being returned didn’t have the extracted values.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 20, 2018, 6:41pm UTC](https://community.graylog.org/t/field-statistics-chart-on-extracted-number-showing-nan/5494/4 "2018-06-20T18:41:43Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.