# Question on data type supported by graylog

**URL:** https://community.graylog.org/t/question-on-data-type-supported-by-graylog/4600
**Category:** Graylog Central (peer support)
**Created:** [March 16, 2018, 1:01pm UTC](https://community.graylog.org/t/question-on-data-type-supported-by-graylog/4600 "2018-03-16T13:01:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![cdeng](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@cdeng](https://community.graylog.org/u/cdeng)
#### Post date: [March 16, 2018, 1:01pm UTC](https://community.graylog.org/t/question-on-data-type-supported-by-graylog/4600/1 "2018-03-16T13:01:54Z")

</div>

when i study on how to make a pipeline, i am confused with the data type supported by graylog, for example, as the statements for function regex:

regex(pattern: string, value: **string** , [group\_names: array[string])

…Returns a match object, with the **boolean** property matches to indicate whether the regular expression matched…

but search in forum, they are writing in the following way:

rule “a rule desc”  
when  
regex(“_the-pattern_”, **to\_string** ($message.message)).matches **== true**  
then  
…  
end

firstly the $message.message in ES was a text data type which was a data type of string, why we need a type conversion by the function to\_string ?

secondly now that the return value of regex(…).matches already a boolean data type, why we need an additional “== true” or to\_bool data type conversion？

---

<div class="post-metadata">

### Author: ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [March 16, 2018, 1:35pm UTC](https://community.graylog.org/t/question-on-data-type-supported-by-graylog/4600/2 "2018-03-16T13:35:51Z")

</div>

The type system used in the pipeline rules is really just a very thin layer over the Java type system with some syntactic sugar for specific types (such as `String` or `Number`).

Under the hood, `$message.message` is using the untyped `Message#getField(String)` method to access the “message” field, which is why you have to explicitly cast it to a `String` (otherwise it would be `Object`):

> <https://github.com/Graylog2/graylog-plugin-pipeline-processor/blob/2.4.3/plugin/src/main/java/org/graylog/plugins/pipelineprocessor/ast/expressions/MessageRefExpression.java#L43>

  

> <https://github.com/Graylog2/graylog2-server/blob/2.4.3/graylog2-server/src/main/java/org/graylog2/plugin/Message.java#L484-L486>

The comparison of the `RegexMatchResult.matches` property with `true` is unnecessary because the type is `Boolean` already, but I’d argue that it makes the intention of the `when` block more clear.

> <https://github.com/Graylog2/graylog-plugin-pipeline-processor/blob/2.4.3/plugin/src/main/java/org/graylog/plugins/pipelineprocessor/functions/strings/RegexMatch.java#L116-L118>

---

<div class="post-metadata">

### Author: ![cdeng](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@cdeng](https://community.graylog.org/u/cdeng)
#### Post date: [March 16, 2018, 1:45pm UTC](https://community.graylog.org/t/question-on-data-type-supported-by-graylog/4600/3 "2018-03-16T13:45:09Z")

</div>

Got it. thank you jochen !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [March 30, 2018, 1:45pm UTC](https://community.graylog.org/t/question-on-data-type-supported-by-graylog/4600/4 "2018-03-30T13:45:21Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.