Extract a value from @Message as float in logsearch and in Kibana calculate the sum from that extracted value

Question

I have a value in my @message part that I need to extract out and then provide the sum of that value for that day. I have written below in my filters-default.conf file

if "NETAMT" in [@message] {
 grok {
  match => { "@message" => "<NETAMT>(?<NETAMT>.*?)<\/NETAMT>" }
 }
 mutate {
  convert => [ "NETAMT", "float" ]
 }
}

The field starts appearing in the Kibana UI [![NETAMT Field][1]][1][1]: https://i.stack.imgur.com/r3uHH.jpg

Now when I am trying to sum it using STATS panel, it always gives 0. [![Panel Setting][1]][1][1]: https://i.stack.imgur.com/RWNQv.jpg

[![Stats Data][1]][1][1]: https://i.stack.imgur.com/QTthu.jpg

Can anyone help here, please?

Answer 1

这在通过 kibana 刷新索引后得到解决，以便新字段变得可索引和可​​搜索。