Pipeline Rule with unexpected result

[mark_a17 (Mark Emmerich)]

Hello everybody,

I created the following pipeline-rule to convert Bytes from a syslog to Megabytes.

rule "Bytes to Megabytes"
when
has_field("Bytes")
then
let mbyte = to_long($message.Bytes);
set_field("MBytes", mbyte / 1048576);
end

Messages are processed by the pipeline and the new field “MBytes“ is inserted.

But when the Bytes value is smaller than 1048576 I always get 0 as result.

Is “long” the wrong data type?

Thanks

[mark_a17 (Mark Emmerich)]

Oh, I see. Long is an integer and therefore the fractional part is discarded. Right?
But when I convert the value to_double I get red cross in the rule source box when trying to devide.

What now?

[Christoph (Christoph Kirchner)]

@mark_a17

rule “Bytes to Megabytes” when has_field(“Bytes”) then let mbyte = to_long($message.Bytes); set_field(“MBytes”, mbyte / 1048576); end

What happens when you convert 1048576 to double?
rule “Bytes to Megabytes”
when
has_field(“Bytes”)
then
let mbyte = to_double($message.Bytes);
set_field(“MBytes”, mbyte / to_double(value:“1048576”));
end

[mark_a17 (Mark Emmerich)]

Great. That’s working.

Thank you Christoph!

Another lesson learned.