Logstash Grok get number field

Question

I use Grok filter in Logstash to break one long message into several fields.

The example Message: http://localhost:8080/MRLService/api/v1/reportNotes 11-24-2016 10:59:49 8ms country=AUS pesticide=ABA3000

filter: filter { grok {match => {"log4j2_message" => "%{URIPATH:url} %{DATESTAMP:startTime} %{NUMBER:timeTaken}ms %{GREEDYDATA:parameters}"}} }

it is working fine except the timetaken (8) is string type instead of number type I supposed,

Could anyone please tell how to make the timetaken field as number in Logstash?

Thanks, Sean

Answer 1

The last is the type

{NUMBER:timeTaken:int}

or just convert the filed to int or float (not suggest due to this will lower performance then the first method)

mutate {
   convert => [ "[geoip][coordinates]", "float"]
}