if (doc['bytes.keyword'].size()!=0) { return Integer.parseInt(doc['bytes.keyword'].value) } This took me a while to figure out! The above only works for Integer (so no 1.1 or 2.22). It works on ELK 7.10 I needed it because I'm using %{COMBINEDAPACHELOG} GROK pattern. That …