Convert JSON Objects to DOUBLE or IPADDR Types Using DPL Rules

mosharref_hossn — Wed, 17 Dec 2025 12:10:55 GMT

I have a log processing rule to capture the HTTP request header data.

I want the data type to be DOUBLE for request size values and IPADDR for IPs.

However, the data always gets parsed as STRING data type.

Any options to fix this issue for log ingest rules?

PARSE(content, "JSON:jsoncontent") | FIELDS_ADD(http.request.size:DOUBLE(jsoncontent[http_info][request_headers][request_size])) | FIELDS_ADD(http.client_ip:IPADDR(jsoncontent[http_info][request_headers][X-Ruxit-Forwarded-For]))

Re: DPL rule: how to convert JSON object to type DOUBLE or IPADDR

IzabelaRokita — Wed, 17 Dec 2025 12:10:29 GMT

Hey @mosharref_hossn ,
I just wanted to check in and see if you still need help with this. If so, I’d be happy to look into it for you! 😊
Please let me know what works best for you.

topic Re: DPL rule: how to convert JSON object to type DOUBLE or IPADDR in DQL

Convert JSON Objects to DOUBLE or IPADDR Types Using DPL Rules

Re: DPL rule: how to convert JSON object to type DOUBLE or IPADDR