logging - How to handle numbers which can also have no values sometimes with Logstash and Elasticsearch? -

i'm trying parse logstash apache-like log file contains numbers represented - instead of 0, %b format string in apache can be:

• %b: size of response in bytes, excluding http headers. in clf format, i.e. '-' rather 0 when no bytes sent.

(from http://httpd.apache.org/docs/2.2/en/mod/mod_log_config.html#formats)

in logstash, i've created pattern follow: nil_number (%{number})|(-) , logstash parses logs.

however, when want insert content of these log files in elasticsearch, if inserted real number first, elasticsearch deduces field integer-like field , inserting - value fails following message:

mapperparsingexception[failed parse [value]];   nested: numberformatexception[for input string: "-"];  

(which can find in elasticsearch's logs).

it looks don't have error if convert fields string before feeding them elasticsearch, it's not ideal solution i'm loosing type of values.

converting value null or 0 before inserting best solution can see now, there other solution? in case, how make conversion in generic (i have "lot" of fields in case) , fast way?

the commonapachelog pattern shows how solve this:

(?:%{number:bytes}|-) 

to explain in more detail requested:

first, let's give bytes field in pattern context:

foo (%{number})|(-) bar 

to see what's going on in rubular, i'll expand %{number} real regxp. becomes:

foo ((?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))))|(-) bar 

now send in inputs:

"foo 123 bar" gives group "123".  looks good! "foo - bar" gives group "-".  it's waste, still ok. 

except these match:

"foo 123 spam" "spam - bar" 

this because "|" ungrouped.

this attempting remedy pattern. looks should have written:

foo (%{number:bytes}|-) bar 

(the initial "?:" unneeded)

it differs yours changing placement of parens make group out of "number or -" instead of 2 groups.

this pattern correctly processes 4 samples used above.