# Pull integer from string

**URL:** <https://community.graylog.org/t/pull-integer-from-string/21930>\
**Category:** Graylog Central (peer support)\
**Created:** [December 3, 2021, 12:38am UTC](https://community.graylog.org/t/pull-integer-from-string/21930 "2021-12-03T00:38:47Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [December 3, 2021, 12:38am UTC](https://community.graylog.org/t/pull-integer-from-string/21930/1 "2021-12-03T00:38:47Z")

</div>

I have a field in the database called RequestLatency. It’s a string composed of a number with a trailing comma. Here’s an example:

`12,`

I want to strip the comma off and convert it to a long int.

I have the following so far…

```auto
rule "RequestLatency_to_long"
// Convert number with trailing comma to long
when
has_field("RequestLatency")
then
let RequestLatency = to_long($message.RequestLatency);
end

```

But the comma is still there.  
I’ve been trying combinations of **grok** and **set\_field** and **regex\_replace** but almost everything a try is just a syntax error that doesn’t even save. I’m trying to read the documentation here…  
[https://docs.graylog.org/v1/docs/functions](https://docs.graylog.org/v1/docs/functions)  
…but I can’t figure out what I’m looking at. If someone knows a site I could lookup to tell me how to interpret the documentation that would be great too!

Thanks.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 3, 2021, 12:55am UTC](https://community.graylog.org/t/pull-integer-from-string/21930/2 "2021-12-03T00:55:21Z")

</div>

Hello,

Is this an extractor that has created the field **RequestLatency**? If so, just an idea, instead of patching up the field **RequestLatency** using a pipeline how about fixing the extractor so it doesn’t have a trailing **“,”**?  
If we could see how this field **RequestLatency** is created and perhaps there is a fix to that. If not, is this something your looking for?

```auto
PUT _ingest/pipeline/my-pipeline-id
{
  "description": "converts the content of the id field to an integer",
  "processors" : [
    {
      "convert" : {
        "field" : "id",
        "type": "integer"
      }
    }
  ]
}

```

Maybe my Pipeline mentor @tmacgbay can have a look 😃

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [December 3, 2021, 1:43am UTC](https://community.graylog.org/t/pull-integer-from-string/21930/3 "2021-12-03T01:43:41Z")

</div>

Thank you for the quick response.  
I don’t know why the comma is getting in there. I’m using the Key-value pair converter on the input and it’s not doing a good job.

I tried a bunch of stuff…

```auto
rule "RequestLatency_to_long"
// Convert number with trailing comma to long
when
has_field("RequestLatency") 
then
let var_x = regex_replace("^(\\d*)", to_string($message.RequestLatency), "$1");
set_field("RequestLatency", var_x);
end

```

Still has the trailing comma in there! I have no idea if **regex\_replace** is the right function to be using here.

Thanks.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [December 3, 2021, 1:47am UTC](https://community.graylog.org/t/pull-integer-from-string/21930/4 "2021-12-03T01:47:49Z")

</div>

Hello

Can we have a look at your configurations for:

> [@danmassa7](#):
>
> Key-value pair converter

And a message that would pertain to that input. Make sure you block out personal information.  
Maybe we can come up with a fix for you. I think that were the problem resides.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [December 3, 2021, 3:16am UTC](https://community.graylog.org/t/pull-integer-from-string/21930/5 "2021-12-03T03:16:43Z")

</div>

I think the below should do it - no need to complicate with regex or grok.

```auto
rule "RequestLatency_to_long"
// Convert number with trailing comma to long
when
has_field("RequestLatency") 
then
let var_x = replace( to_string($message.RequestLatency), ",","");
set_field("RequestLatency", to_long(var_x));
end

```

It would be more efficient to fix it in the key\_value extractor you are using - @gsmith is the guru there… 😃 If you post your anonymized extractor and example message there may be a fix.

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [December 3, 2021, 12:57pm UTC](https://community.graylog.org/t/pull-integer-from-string/21930/6 "2021-12-03T12:57:15Z")

</div>

This code you provided worked great. Thank you! I’ll put this in my cookbook of reusable component’s.

But @gsmith is right. It would be nice if the parser on the input didn’t put trailing commas in the field. In fact, it’s doing it to all my key=value pairs, but RequestLatency was the one that was harassing me today.

I’ll start a different thread on the trailing comma issue.  
Thanks!

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [December 3, 2021, 1:13pm UTC](https://community.graylog.org/t/pull-integer-from-string/21930/7 "2021-12-03T13:13:26Z")

</div>

@tmacgbay Actually, I think this is still not working. I’m having problems with running max() and avg() on this field. I think it’s still a string. When I do a search and look at a record and hover over the field it says **RequestLatency = string**.

Is it possible that it’s still a string?

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [December 3, 2021, 1:27pm UTC](https://community.graylog.org/t/pull-integer-from-string/21930/8 "2021-12-03T13:27:40Z")

</div>

I should have mentioned that. It will still be a string until you rotate the index it is in. Elasticsearch maintains the type until the index is incremented. All previous indexes will retain it as a string. There is a way to fix that that I wrote up but it is a rather involved process - you can find it [here](https://community.graylog.org/t/fye-custom-index-mapping-historical-correction/16834) if you are interested.

Also - mark the answer for this topic so others can find it easily. 😃

---

<div class="post-metadata">

**Author:** ![danmassa7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/danmassa7/32/9723_2.png) [@danmassa7](https://community.graylog.org/u/danmassa7)\
**Post date:** [December 3, 2021, 1:37pm UTC](https://community.graylog.org/t/pull-integer-from-string/21930/9 "2021-12-03T13:37:17Z")

</div>

Oh, man. I looked at your post for the fix. I suspect I have another 60 hours of uninterrupted deep dive on how this all works before I can figure out what you’re describing. Maybe when I retire in 2052 I can devote some time into how ElasticSearch works!

My indexes rotate ever 24 hours. If I wait 24 hours and if I don’t run avg() across data more than 24 hours old, will I get it to work? And by Monday I’ll be able to run graphs 48 hours old, etc.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [December 3, 2021, 1:48pm UTC](https://community.graylog.org/t/pull-integer-from-string/21930/10 "2021-12-03T13:48:41Z")

</div>

Ha! I don’t know a thing about Elasticsearch - that was all google-fu…

You can manually rotate the index by going to it, clicking on Maintenance and selecting Rotate Active Write Index.

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e9317a92c29aed171dea0b84ec4d0fc54c37c947.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 17, 2021, 1:49pm UTC](https://community.graylog.org/t/pull-integer-from-string/21930/11 "2021-12-17T13:49:13Z")

</div>

Closed on December 17, 2021, 1:49pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.