Getting a NaN for mean value

(Archimedes Trajano) #1

I am trying to create a chart with the average response times when I do Quick Values I don’t see anything that would be wrong.

(Ben van Staveren) #2

Chances are that your values are stored as strings - Elasticsearch has this habit at times to not auto-detect the type of field data properly, and Graylog doesn’t really attempt it either because how would it know.

Solution: set up a pipeline for that stream, and use one of the to_float/to_double/to_etcetcetc. functions to ensure the field is stored numerically. You’ll keep having NaN for a while in the mean value (depending on time range) until all data points inside the time range are numeric, after which it’ll start working.

(Archimedes Trajano) #3

I was actually thinking that myself so I created a rule

rule "requestTimeInMillis to number"
  let millis = to_double($message.requestTimeInMillis);
  set_field("requestTimeInMillis", millis);

And attached it to the pipeline.

(Archimedes Trajano) #4

I wonder if there is a way to check the type of the field somehow

(Ben van Staveren) #5

Eaaahhhmm… there may be but you’d have to talk to Elasticsearch directly and request the index mapping, see if it comes out right. I think…

(Archimedes Trajano) #6

I take it Graylog does not have a facility to override it.

(Archimedes Trajano) #7

It looks like it is stored as keyword

  "graylog_0" : {
    "mappings" : {
      "message" : {
        "dynamic_templates" : [
            "internal_fields" : {
              "match" : "gl2_*",
              "mapping" : {
                "type" : "keyword"
            "store_generic" : {
              "match_mapping_type" : "string",
              "mapping" : {
                "type" : "keyword"
        "properties" : {

         "requestTimeInMillis" : {
            "type" : "keyword"
          "response" : {

(Archimedes Trajano) #8

I’m trying to check if “_reindex” can be used.

(Archimedes Trajano) #9

I wonder if numeric_detection as documented here is enabled in GrayLog

(system) closed #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.