Ok, thats a semi-colon... That works. This is awesome.
On Thursday, 4 June 2015 16:29:40 UTC+2, Kay Roepke wrote: > > Hi! > > Version 1.1.0 ships with data type conversions in Grok patterns, yes. > To verify I've just set one up, on a Raw TCP input. > It splits input like: > > somekey:345345 > > into two fields: key and value. > > > <https://lh3.googleusercontent.com/-6q_fygDhb8c/VXBgYkpaOaI/AAAAAAAAADs/kPQmqNHP2mI/s1600/screenshot.png> > The format for grok conversions is: > %{PATTERNAME:fieldname;dataype} > > You cannot leave out the fieldname, so %{INT;int} won't work. (You want to > assign field names anyway for clarity). > > I can then successfully get the field statistics on field 'value'. > > HTH, > Kay > > On Thursday, 4 June 2015 14:49:08 UTC+2, Martin René Mortensen wrote: >> >> It is in the current 1.1 beta 3 ? >> >> From the version notes: >> >> *Server * >> >> - Enhanced Grok support with type conversions (integers, doubles and >> dates) >> >> >> I can't get it to work thou - I add :int to a http status for example, >> but the field just disappears. >> >> >> On Thursday, 19 March 2015 17:29:15 UTC+1, Kay Röpke wrote: >>> >>> Not in the version we are using right now, but we plan on upgrading the >>> java grok version to support this. >>> >>> Best, >>> Kay >>> On Mar 19, 2015 3:01 PM, "Jerri Son" <[email protected]> wrote: >>> >>>> Hi there, >>>> >>>> reading this: >>>> https://github.com/Graylog2/graylog2-server/issues/377#issuecomment-43436017 >>>> >>>> I was wondering >>>> if GROK-conversion are implemented already? >>>> >>>> The obvious uses are of course to convert string to ints/floats so we >>>> can do "math" on logs. >>>> >>>> As it is right now, when i add ":int" or ":float" the output field just >>>> gets extended to ie "myfieldname:int". >>>> >>>> I might just have the syntax wrong though :) >>>> >>>> Cheers! >>>> >>>> -- >>>> You received this message because you are subscribed to the Google >>>> Groups "graylog2" group. >>>> To unsubscribe from this group and stop receiving emails from it, send >>>> an email to [email protected]. >>>> For more options, visit https://groups.google.com/d/optout. >>>> >>> -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
