Skip to content

ES|QL: Grok only supports KEYWORD or TEXT values, found expression [type] type [INTEGER] #127468

@luigidellaquila

Description

@luigidellaquila

With CSV dataset

from multivalue_points,h*,messa* | eval `card` = true, PbehoQUqKSF = "VLGjhcgNkQiEVyCLo", DsxMWtGL = true, qSxTIvUorMim = true, `location` = 8593178066470220111, type = -446161601, FSkGQkgmS = false | eval PbehoQUqKSF = 753987034, HLNMQfQj = true, `within` = true, `id` = "JDKKkYwhhh", lk = null, aecuvjTkgZza = 510616700, aDAMpuVtNX = null, qCopgNZPt = "AjhJUtZefqKdJYH", BxHHlFoA = "isBrmhKLc" | rename message as message | lookup join message_types_lookup on message | sort PbehoQUqKSF DESC, ip1 DESC NULLS LAST | limit 5845 | drop `subset`, ip*, `card`, `within`, host.v*, description, `aecuvjTkgZza`, host.version, `ip0`, height_range, DsxMWtGL, host_group, `aDAMpuVtNX`, PbehoQUqKSF, `intersects`, `host.os`, aDAMpuVtNX, *ight_range, HLNMQfQj, `FSkGQkgmS`, BxHHlFoA, card | grok type "%{WORD:GknCxQFo}" | eval `location` = null, ZjWUUvGusyyz = null, HeeKIpzgh = false, `id` = 4325287503714500302, host = false, `lk` = null, HvTQdOqFajpH = false, fKNlsYoT = true, `location` = -1158449473, `qCopgNZPt` = 1219986202615280617 | drop HeeKIpzg*, `ZjWUUvGusyyz`, `message`, `type`, `lk` | grok GknCxQFo "%{WORD:location} %{WORD:HvTQdOqFajpH}" | drop HvTQdOqFajpH, `location`, centroid | mv_expand GknCxQFo | limit 410 | limit 3815 | rename `id` AS `GknCxQFo` | grok host.name "%{WORD:oGQQZHxQHj} %{WORD:qCopgNZPt} %{WORD:vHKOmmocPcTO}" | stats BkQXJRMeAM = min(GknCxQFo) | keep `BkQXJRMeAM` 
verification_exception�reason Found 1 problem | line 1:787: Grok only supports KEYWORD or TEXT values, found expression [type] type [INTEGER] 

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions