Problem with numeric field created by JSON extractor


(Peter) #1

Hi all,

I experience strange behaviour regarding a numeric field created by JSON extractor.

  • When I want to generate a chart of it, I get an error saying “Could not create field graph Field graphs are only available for numeric fields.”
  • When creating statistics, I get NaN values for all numeric fields.
  • It seems it is a string. However, when I want to add a converter to it by pressing action button at the right side of the field the option is disabled saying “Extractors can only be used with string fields”

This is the message I extract fields from, the field in question is durationMs:
{"stage":"WorkflowScript","buildName":"jenkins-tester-35","node":"master","durationMs":1244,"success":true}

Everything seems working fine apart from using durationMs as numeric field.
I’m quite stuck here, any help is much appreciated.

Thanks, Peter


(Jochen) #2

Are you sure that the durationMs field has a numeric type in all indices covered by your search queries? The field mapping can be different from index to index.

Try reducing the time range of your queries for testing.

You could also create a custom Elasticsearch index mapping for your data: http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html#custom-index-mappings


(Peter) #3

Hi Jochen,

No I’m not sure at all about indices.

What I found since posting my question is that if I rename this field on source side e.g. to durationMs2 than it works as supposed. Than I found that some earlier tests sent this field as string by accident, so I guess this is the source of confusion.

Is there a way to convert those early string fields (created this morning) to number? Sorry if it is lame question, I’m very new to graylog and totally lame to elastic.

Thanks!


(Jochen) #4

You could try using the Elasticsearch Reindex API for this: https://www.elastic.co/guide/en/elasticsearch/reference/2.4/docs-reindex.html


(Peter) #5

It’s ok now, thanks a lot for your help!


(system) #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.