Graylog pipeline problem

Dear all,

I designed the pipeline to calculate the download speed basic on size and time. The function is fine. However, I want to the speed_kb_sec can change to integer(No decimal point). Can you have any solution about it?
My pipeline is listed in the below:

when
 has_field("spendtime")
then
    let time = to_double($message.spendtime);
    let size = to_double($message.bytes);
    let bandwidth = size / time ;
    let bandwidth_kb = to_double(bandwidth / 1024.0);
    set_field("speed_bytes_sec", bandwidth);
    set_field("speed_kb_sec", bandwidth_kb);
end

For example,
speed_kb_sec:1064.092460042956 (current)
I want to change speed_kb_sec:1064

Many Thanks

You can use the to_long() function for that purpose.

Hi Joechen, Thanks your reply. you means

when
has_field(“spendtime”)
then
let time = to_double($message.spendtime);
let size = to_double($message.bytes);
let bandwidth = size / time ;
let bandwidth_kb = to_long (bandwidth / 1024.0);
set_field(“speed_bytes_sec”, bandwidth);
set_field(“speed_kb_sec”, bandwidth_kb);
end

?
Sorry for my newbie question.

Yes, that could work.

Thanks Bro! You are many helpful for me.

Joechen, Sorry about that.
If i change to_double to to_long, look like the above reply. The bandwidth_kb will be 0 for all case.

when
has_field(“spendtime”)
then
let time = to_double($message.spendtime);
let size = to_double($message.bytes);
let bandwidth = size / time ;
let bandwidth_kb = to_long(bandwidth / 1024.0);
set_field(“speed_bytes_sec”, bandwidth);
set_field(“speed_kb_sec”, bandwidth_kb);
end

speed_bytes_sec 67548.1865284974
speed_kb_sec 0

It looks like this is a bug in the to_long() function. This will be fixed in Graylog 2.4.0:

https://github.com/Graylog2/graylog-plugin-pipeline-processor/pull/219

Dear joechen

Thanks your reply. If I want to edit the pipeline to avoid to_double/to_long problem. How can I do that?

As an ugly workaround, you could convert bandwidth / 1024.0 to a string (using to_string()), then split on the decimal point using split() or regex(), and then convert the result to a long integer (using to_long()).

Not nice, but it should work for now.

OK. I try to use the ugly workaround first. Hope that it can solve the problem.

deleted. deleted.Thanks!

deleted. deleted.Thanks!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.