# Search for numbers only evaluate frist chr **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 1, 2018, 2:07pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133 "2018-05-01T14:07:29Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Snowy](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Snowy](https://community.graylog.org/u/Snowy)\ **Post date:** [May 1, 2018, 2:07pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/1 "2018-05-01T14:07:29Z")
Hi! Been trying to figgure this one out for a while, and cant understand what I do wrong here. When searching for ex mynumber:[50 TO 90] It will return all numbers that start with 5,6,7,8,9 not only nubmer between 50 and 90 So i would get like, 5,6,50,55,560,698222 and so on Did try to extract as BASE10NUM and NUMBER. Both works and seems ok, but when searching i only get results from first character in number. Any ideeas? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [May 2, 2018, 6:05am UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/2 "2018-05-02T06:05:45Z")
hej @Snowy is `mynumber` saved as number in Elasticsearch? ---
**Author:** ![Snowy](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Snowy](https://community.graylog.org/u/Snowy)\ **Post date:** [May 2, 2018, 6:22am UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/3 "2018-05-02T06:22:16Z")
> [@jan](#): > > mynumber saved as number in Elasticsearch? Hey back 🙂 Been strugeling to make sure what it is saved as. Everything looks like it is stored as number (integer), but how to make sure I am no aware of. Anyt tips on how to se the type a value is stored as? **EDIT** **Interesting finding.** **Tried this on two different servers.** **Both give a numeric on a “bytes” value and “bytes:[100 TO 200]” works fine** **But on both servers when looking at timed values, but should be stored as numeric the Seconds and Mileseconds come out as I mentioned here. It only evaluates the first chr in the number.** Best regards Snowy ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [May 2, 2018, 8:01am UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/4 "2018-05-02T08:01:22Z")
you can look into the mapping of one index in elasticsearch with the curl commands from this elasticsearch docs: [https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-get-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-get-mapping.html) If you want to ensure that specific items are stored with specific settings, look at: [http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings](http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings) ---
**Author:** ![Snowy](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Snowy](https://community.graylog.org/u/Snowy)\ **Post date:** [May 2, 2018, 1:19pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/5 "2018-05-02T13:19:44Z")
Hi and thaks a lot for helping out. I dont get any response from port 9200 but at port 9000 I get the folowing. The documentation looks different from my result, and I cant se anything I could do to attac the problem here. Is it because I run a newer version? Best regards ![20](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/496b853d555870001e4f5b84cb9ca671a8591a87.png) ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [May 2, 2018, 1:32pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/6 "2018-05-02T13:32:59Z")
you need to run the curl command on the elasticsearch server and not on the Graylog server. ---
**Author:** ![Snowy](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Snowy](https://community.graylog.org/u/Snowy)\ **Post date:** [May 2, 2018, 1:49pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/7 "2018-05-02T13:49:04Z")
> [@jan](#): > > curl command on the elasticsearch server and not on the Graylog serve Hi and thanks again. This is a one stop server, all roles on the same server. Should it accept the curl command on port 9200? And 9200 then should represent elasticsearch? Snowy ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [May 2, 2018, 1:56pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/8 "2018-05-02T13:56:09Z")
you might have elasticsearch noch listening on localhost - check your configuration where you bind the elasticseach server to. ---
**Author:** ![Snowy](https://avatars.discourse-cdn.com/v4/letter/s/58f4c7/32.png) [@Snowy](https://community.graylog.org/u/Snowy)\ **Post date:** [May 2, 2018, 9:26pm UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/9 "2018-05-02T21:26:29Z")
Hi and thanks again @jan When runing curl from another host towards the graylog server on port 9200 it worked. curl -X GET “192.168.1.195:9200/graylog\_27/\_mapping” Found the value to be {“type”:“keyword”},“ElapsedTime”:{“type”:“keyword”} So I added an extractor to convert it. Cut dident do it, but a Copy and new Field did the trick. ![48](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b0ea640318ffbf643789824bb5ba8c25573bdb42.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 17, 2018, 10:56am UTC](https://community.graylog.org/t/search-for-numbers-only-evaluate-frist-chr/5133/10 "2018-05-17T10:56:04Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.