Hi! Version 1.1.0 ships with data type conversions in Grok patterns, yes. To verify I've just set one up, on a Raw TCP input. It splits input like:
somekey:345345 into two fields: key and value. <https://lh3.googleusercontent.com/-6q_fygDhb8c/VXBgYkpaOaI/AAAAAAAAADs/kPQmqNHP2mI/s1600/screenshot.png> The format for grok conversions is: %{PATTERNAME:fieldname;dataype} You cannot leave out the fieldname, so %{INT;int} won't work. (You want to assign field names anyway for clarity). I can then successfully get the field statistics on field 'value'. HTH, Kay On Thursday, 4 June 2015 14:49:08 UTC+2, Martin René Mortensen wrote: > > It is in the current 1.1 beta 3 ? > > From the version notes: > > *Server * > > - Enhanced Grok support with type conversions (integers, doubles and > dates) > > > I can't get it to work thou - I add :int to a http status for example, but > the field just disappears. > > > On Thursday, 19 March 2015 17:29:15 UTC+1, Kay Röpke wrote: >> >> Not in the version we are using right now, but we plan on upgrading the >> java grok version to support this. >> >> Best, >> Kay >> On Mar 19, 2015 3:01 PM, "Jerri Son" <[email protected]> wrote: >> >>> Hi there, >>> >>> reading this: >>> https://github.com/Graylog2/graylog2-server/issues/377#issuecomment-43436017 >>> >>> I was wondering >>> if GROK-conversion are implemented already? >>> >>> The obvious uses are of course to convert string to ints/floats so we >>> can do "math" on logs. >>> >>> As it is right now, when i add ":int" or ":float" the output field just >>> gets extended to ie "myfieldname:int". >>> >>> I might just have the syntax wrong though :) >>> >>> Cheers! >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "graylog2" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to [email protected]. >>> For more options, visit https://groups.google.com/d/optout. >>> >> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
