zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat g01.conf input {stdin{}} filter { grok { match => { "message" =>"s+(?<request_time>d+(?:.d+)?)s+" } } mutate { convert => [ "request_time", "float"] } } output { stdout { codec => rubydebug{} } } zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f g01.conf Settings: Default pipeline workers: 1 Pipeline main started begin 123.456 end { "message" => "begin 123.456 end", "@version" => "1", "@timestamp" => "2016-09-11T05:31:32.576Z", "host" => "0.0.0.0", "request_time" => "123.456" } 此时 "request_time" => "123.456" 输出的是字符串 zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat g01.conf input {stdin{}} filter { grok { match => { "message" =>"s+(?<request_time>d+(?:.d+)?)s+" } } mutate { convert => [ "request_time", "float"] } } output { stdout { codec => rubydebug{} } zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f g01.conf Settings: Default pipeline workers: 1 Pipeline main started begin 123.456 end { "message" => "begin 123.456 end", "@version" => "1", "@timestamp" => "2016-09-11T05:34:13.040Z", "host" => "0.0.0.0", "request_time" => 123.456 } 把字符串转换为 float型