Pipeline Rule with unexpected result


(Mark Emmerich) #1

Hello everybody,

I created the following pipeline-rule to convert Bytes from a syslog to Megabytes.

rule "Bytes to Megabytes"
when
has_field("Bytes")
then
let mbyte = to_long($message.Bytes);
set_field("MBytes", mbyte / 1048576);
end

Messages are processed by the pipeline and the new field “MBytes“ is inserted.

But when the Bytes value is smaller than 1048576 I always get 0 as result.

Is “long” the wrong data type?

Thanks


(Mark Emmerich) #2

Oh, I see. Long is an integer and therefore the fractional part is discarded. Right?
But when I convert the value to_double I get red cross in the rule source box when trying to devide.

What now?


(Christoph Kirchner) #3

What happens when you convert 1048576 to double?
rule “Bytes to Megabytes”
when
has_field(“Bytes”)
then
let mbyte = to_double($message.Bytes);
set_field(“MBytes”, mbyte / to_double(value:“1048576”));
end


(Mark Emmerich) #4

Great. That’s working.

Thank you Christoph!

Another lesson learned.