Grok pattern field still being extracted as string not integer

[dcecchino]

Hello,

I have a pattern that is still producing a string and not being described as an integer. I’ve seen some things where an index should be rotated first, but not sure how to force that. Any suggestions on this?

%{NUMBER:unisphere_id;int}

[tmacgbay]

In the docs here, scroll to the second picture where you have clicked on the index set… In the upper right there is a blue “maintenance” button this is where you can rotate the index.

Elastic takes a guess at what type to store data at - if you are forcing a number it should be a number for future indexes. There is a rather involved method for correcting the past indexes if you are interested - There is an official write up on it around here somewhere you can search for or I have a half-baked one I wrote up before that.