logstash-plugins / logstash-filter-dissect

Extract structured fields from an unstructured line
Apache License 2.0
13 stars 22 forks source link

convert_datatype changes number value to INTEGER.MAX when its too large #12

Closed ppf2 closed 7 years ago

ppf2 commented 7 years ago

convert_datatype takes either int or float options today.

However, if you run a long value through the convert_datatype, it allows it. However, the dissect -> convert_datatype will change the value of the field to INTEGER.MAX

Source value:

  "supportID" => "4394740425750718628"

Output value:

"supportID" => 2147483647

To workaround this, instead of using convert_datatype for dissect, I am post-processing it using mutate/convert:

  mutate {
    convert => { "supportID" => "integer" }
  }

Which returns the correct result:

"supportID" => 4394740425750718628

If we do not intend to support longs like mutate/convert does, it will be better if we throw an error on the configuration instead of auto-converting the value to integer.max.

guyboertje commented 7 years ago

You are correct. Will fix. This was me confusing the Ruby Integer (Fixnum) which is actually a Java long.

guyboertje commented 7 years ago

Will be fixed in #34

guyboertje commented 7 years ago

fixed with #34