title: can't force GROK parser to enforce integer/float types on haproxy logs
body: <p>Doesn't matter if integer/long or float, fields like time_duration (all time_* really ) map as strings in kibana logstash index.</p>
  
  <p>I tried using mutate (<a href="https://www.elastic.co/blog/little-logstash-lessons-part-using-grok-mutate-type-data" rel="nofollow">https://www.elastic.co/blog/little-logstash-lessons-part-using-grok-mutate-type-data</a>) did not work either.</p>
  
  <p>How can i correctly enforce numeric type instead of strings on these fields?</p>
  
  <p>My /etc/logstash/conf.d/haproxy.conf:</p>
  
  <pre><code>input {
    syslog {
      type =&gt; haproxy
      port =&gt; 5515
    }
  }
  filter {
    if [type] == "haproxy" { 
      grok {
        patterns_dir =&gt; "/usr/local/etc/logstash/patterns"
        match =&gt; ["message", "%{HAPROXYHTTP}"]
        named_captures_only =&gt; true
      }
      geoip {
        source =&gt; "client_ip"
        target =&gt; "geoip"
        database =&gt; "/etc/logstash/GeoLiteCity.dat"
        add_field =&gt; [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
        add_field =&gt; [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
      }
      mutate {
        convert =&gt; [ "[geoip][coordinates]", "float"]
      }
    }
  }
  </code></pre>
  
  <p>And my pattern for HAPROXYHTTP:</p>
  
  <pre><code>HAPROXYHTTP  %{IP:client_ip}:%{INT:client_port} \[%{HAPROXYDATE:accept_date}\] %{NOTSPACE:frontend_name} %{NOTSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:time_request:int}/%{INT:time_queue:int}/%{INT:time_backend_connect:int}/%{INT:time_backend_response:int}/%{NOTSPACE:time_duration:int} %{INT:http_status_code} %{NOTSPACE:bytes_read:int} %{DATA:captured_request_cookie} %{DATA:captured_response_cookie} %{NOTSPACE:termination_state} %{INT:actconn:int}/%{INT:feconn:int}/%{INT:beconn:int}/%{INT:srvconn:int}/%{NOTSPACE:retries:int} %{INT:srv_queue:int}/%{INT:backend_queue:int} (\{%{HAPROXYCAPTUREDREQUESTHEADERS}\})?( )?(\{%{HAPROXYCAPTUREDRESPONSEHEADERS}\})?( )?"(&lt;BADREQ&gt;|(%{WORD:http_verb} (%{URIPROTO:http_proto}://)?(?:%{USER:http_user}(?::[^@]*)?@)?(?:%{URIHOST:http_host})?(?:%{URIPATHPARAM:http_request})?( HTTP/%{NUMBER:http_version})?))?"
  </code></pre>