Logstash grok过滤整数

Question

I need to index numerical data in my ElasticSearch DB and i'm using grok filter to parse the log line (which is all comma separated integers).

trying to use this format %{NUMBER:userID_2:int} did not work and no data was indexed and no exception appeared.

When i changed the type to "float" -ie %{NUMBER:userID_2:float} it worked just fine.

Any idea why i'm not able to index integers?

(Using elastic 1.4.4 and logstash 1.4.1)

Thanks!

Answer 1

In "filter" section you set up match expression:

match => "%{NUMBER:user_id}"

and then you convert it:

mutate {
  convert => {
    "user_id" => "integer"
    ....
  }
}