最近我部署了elk并开始通过logstash frowarder转发nginx的日志。
问题是，在elasticsearch（1.4.2）/kibana（4）中，请求的“bytes”值Map为字符串。
我使用随处可见的标准配置。
在logstash模式中添加了nginx日志的新模式：

NGUSERNAME [a-zA-Z\.\@\-\+_%]+                                                                                                                                                                                                                      
NGUSER %{NGUSERNAME}                                                                                                                                                                                                                                
NGINXACCESS %{IPORHOST:http_host} %{IPORHOST:clientip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{NUMBER:request_time:float} %{NUMBER:upstream_time:float}
NGINXACCESS %{IPORHOST:http_host} %{IPORHOST:clientip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{NUMBER:request_time:float}

为日志存储添加了这些配置

input {
  lumberjack {
    port => 5000
    type => "logs"
    ssl_certificate => "/etc/logstash/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/logstash/tls/private/logstash-forwarder.key"
  }
}
filter {
    if [type] == "syslog" {
        grok {
            match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
            add_field => [ "received_at", "%{@timestamp}" ]
            add_field => [ "received_from", "%{host}" ]
        }
        syslog_pri { }
        date {
            match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
    } else if [type] == "nginx" {
        grok {
            match => { "message" => "%{NGINXACCESS}" }
        }
        date {
            match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
        }
        geoip {
            source => "clientip"
        }
    }
}
output {
  elasticsearch_http {
    host => localhost
  }
}

但在elsticsearch中，我将其视为字符串，即使我将“字节”定义为

(?:%{NUMBER:bytes:long}|-)

有人知道如何将“字节”存储为数字类型吗？
谢谢