Pipeline Rule - converted numbers changed to zeros

Graylog Central (peer support)
, , , ,
14

Thanks Jan. I’ve read that document several times, and as far as I can tell I’m doing things correctly. I read in a string from a raw/Plaintext input. Here’s an example:

`NBUDiskPool,PureDisk,dp_disk_nbu5230-03,80994,12072,85`

I split the line into new fields using a pipeline rule. At this point, the values are strings. If I convert them to numbers in the rule, the values become zeros (see initial problem description) Here’s the output from the Graylog Simulator for that Pipeline:

image

I have created a custom mapping file for Elasticsearch as follows:

{
  "template": "graylog_*",
  "mappings" : {
    "message" : {
      "properties" : {
        "DP_Capacity" : {
          "type" : "long"
        },
        "DP_FreeSpace" : {
          "type" : "long"
        },
        "DP_PercentUsed" : {
          "type" : "long"
        }
      }
    }
  }
}

So as it stands, if I try to store the string representation of a number like 80994 into a numeric field in Elasticsearch, I get a datatype mismatch error. If I try to convert the string to a number in Graylog first, and then store it in Elasticsearch, the value is always zero. Am I missing a step somewhere? I’ve read every document that I can find on the subject from both Graylog and Elasticsearch.