I am pretty sure that would work fine - I haven’t set type in GROK for Graylog but it makes sense to me that ElasticSearch would pick it up as a float when you rotate the index. One thing to note, I have generally used long instead of float and I know Graylog is particular about field types… it doesn’t use all the ones that Elasticsearch makes available. don’t forget to rotate the index to make the change. If you want to get into changing the historical data as well, this is the post I put up on how to do that:
