Convert a string to integer in Kibana with painless

if (doc['bytes.keyword'].size()!=0) {
    return Integer.parseInt(doc['bytes.keyword'].value)
}

This took me a while to figure out!

The above only works for Integer (so no 1.1 or 2.22).

It works on ELK 7.10

I needed it because I’m using %{COMBINEDAPACHELOG} GROK pattern.

That GROK pattern is built-in with logstash and just says NUMBER:bytes and number is (?:%{BASE10NUM})

https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/httpd#L5

There’s actually a way to specify in the grok pattern that it’s an integer:

%{NUMBER:field:integer}

https://github.com/logstash-plugins/logstash-patterns-core/issues/173 is an open issue from 2016 about this issue.

I guess what I should do is just make my own pattern with this fixed where I want it… I would really like to not fiddle with templates or add logstash mutate rules..

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.