Search for greater than is ignored

Graylog Central (peer support)
1

Hello!

We have in our logfile message like this.
Interface: Read orders took 93476 ms, Read 26 items
We want to filter out the milliseconds and check
whether these are greater than 15 minutes or 900000 milliseconds.
For this I wrote a Grokpattern
%{WORD:source}%{SPACE}%{NUMBER:duration:int}%{SPACE}%{WORD:ms}.\s%{WORD:action}
This one works quite well so far. But unfortunately the > is ignored.
When I use the search with message: "Read orders took" AND duration:>900000
will not be filtered but all those with values like 94543 will be displayed
I suppose it is because “duration” is kept as datatype unkown.

graylog
What am I doing wrong here?

Greetings georg

2

You use wrong format : instread of ; before int
%{NUMBER:duration;int}

3

Hello,

Thanks for your hint

OK I have corrected it. But now the number is recognized as a string instead of a number :wink:

%{WORD:source}%{SPACE}%{NUMBER:duration;int}%{SPACE}%{WORD:ms}.\s%{WORD:action}

graylog2

4

It’s how Elastic Search works, if you first save value as string (it guests by value), another values will be same type. You can create own custum mapping for this field:

Or use another name, which was not used before.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.