grok


Graylog cannot look a field as numeric


I use Graylog 2.10.0 to collect the logs. I set a Grok pattern to parse my log, and one field is
%{NUMBER:consume_time;int}ms,and it works well, I capture consume_time correctly, but when I try to use "statistics" function, it only show "Total" and "Cardinality", the other fields are marked as "NaN"。
And I also check the document type in ElasticSearch, it shows the type of "consume_time" is "long".
Anyone can tell me why?
It's possible that the consume_time field contained non-numeric values before (in older indices) and the time frame you've selected includes those values.
Try cycling indices (System → Indices → Maintenance) and only select a time frame including this new index to verify this guess.

Related Links

Grok Learning - 'Halve This'
logstash grok patterns assistance
Using multiple grok pattern to assign value to 1 field
Graylog cannot look a field as numeric
Logstatsh help needed to write grok filter
How to have timestamp as the only delimiter in Grok Logstach?
Error compiling Grok
logstash grok filter annoyance

Categories

HOME
cobalt
amp-html
angular-formly
swt
devise
appcelerator
yandex
rom
telegram-bot
pearson-correlation
retrofit2
opengl-3
flume
recordrtc
arangodb
project
little-proxy
fhir
github-enterprise
java.util.logging
filechannel
jsonpath
naivebayes
code-generation
3nf
altera
parameter-passing
firefox-addon
feathersjs
google-content-api
google-data-studio
boost-icl
solrcloud
selinux
onload
syntax-highlighting
ms-access-web-app
browser-sync
failover
dotspatial
zend-debugger
cognos-bi
gnat-gps
salesforce-communities
dm-script
reactivekit
railstutorial.org
verifiable-c
urlsession
news
portforwarding
bindingnavigator
angular-http
android-exoplayer
procfile
plan-9
double-click
launchctl
tf
carrot2
java-6
skin
cup
bbpress
oozie-coordinator
universal-analytics
baidu
vibrate
pure-css
stax
centrifuge
riot
atan2
opl
grgit
fiware-monitoring
computer-architecture
ess
morton-number
zen-cart
skspritenode
typeconverter
actionfilterattribute
cross-join
reflector
draw2d-js
sbcl
ie8-compatibility-mode
rolify
mvc-editor-templates
apache-abdera
twisted.web
bjyauthorize
iboutlet
pyunit
rmiregistry
predicatebuilder
relative
workflow-services
pylucene
dataform
cuda.net
dojo-dnd

Resources

Encrypt Message



code
soft
python
ios
c
html
jquery
cloud
mobile