i use graylog 2.10.0 collect logs. set grok pattern parse log, , 1 field %{number:consume_time;int}ms
,and works well, capture consume_time correctly, when try use "statistics" function, show "total" , "cardinality", other fields marked "nan"。
and check document type in elasticsearch, shows type of "consume_time" "long".
anyone can tell me why?
it's possible consume_time
field contained non-numeric values before (in older indices) , time frame you've selected includes values.
try cycling indices (system → indices → maintenance) , select time frame including new index verify guess.
Comments
Post a Comment