What is the last part in the grok match pattern?

Question

I've noticed some people use the 3rd part in a grok matching predicate, like

%{NUMBER:response_status:int}
                          ^--- ??

It's obvious what first 2 mean, and I can guess that the 3rd one is an explicit type of the result, but I cannot find the comprehensive explanation of what that 3rd part is.

I checked in both Logstash documentation and in Grok's one and cannot see any traces of the comprehensive syntax description.

Any references?

UPD:

here is an example that it works and is syntactically correct:

For the config file:

input { stdin { } }

filter {
    grok {
        match => [
            "message", "%{NUMBER:a_number:float}"
        ]
    }
}

output { stdout { codec => rubydebug } }

The output for the 12345 is:

{
   "message" => "12345",
  "@version" => "1",
"@timestamp" => "2014-10-08T01:08:49.087Z",
      "host" => "logstash",
  "a_number" => 12345.0
}

If you remove :float then it changes to

{
   "message" => "12345",
  "@version" => "1",
"@timestamp" => "2014-10-08T01:09:46.055Z",
      "host" => "logstash",
  "a_number" => "12345"
}

This is true for at least logstash v1.4.2

Can you provide where do you see people use 3 part in a grok? So far, I never see anyone use 3 part in logstash grok. — Ben Lim
@BenLim for example here gist.githubusercontent.com/poolski/9911628/raw/postfix.grok (just a random result, not the one I use). And it really affects the result: the type of matched result is a string by default and changed to an integer with the given modifier. — zerkms
The 3 parts in grok is invalid in logstash. You can refer to here: github.com/elasticsearch/logstash/blob/v1.4.2/patterns/…. So, I think logstash can't use 3 parts grok. — Ben Lim
@BenLim: "The 3 parts in grok is invalid in logstas" --- it's not true. See the update to the question — zerkms

evivasp evivasp · Accepted Answer · 2014-11-13T18:02:49

This is correct. All data are saved as a string by default. Optionally, there are two ways to coerce the type of data, with grok and mutate. This article explains this ... check out "coercing a data type in logstash" in http://www.elasticsearch.org/blog/little-logstash-lessons-part-using-grok-mutate-type-data/

What is the last part in the grok match pattern?

2 Answers