Bytes

Mutate Elastic Compatible

Synopsis

Converts string field values expressing size in byte units to their numeric value in bytes.

Schema

- bytes:
    field: <ident>
    description: <text>
    if: <script>
    ignore_missing: <boolean>
    ignore_failure: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y		The field containing the unit values
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_missing	N	`false``	If true and field does not exist or contains no value, exit quietly without making any modifications
ignore_failure	N	-
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration
target_field	N	-	Field to assign the converted value to, if distinct from field

Details

If the field contains multiple values, all of them are converted.

Allowed units are B, KB, MB, GB, TB and PB, all case-insensitive, and each also accepts its IEC spelling — KiB, MiB, GiB, TiB, PiB — which is folded onto the short form.

Every prefix is 1024-based, whichever spelling is used: 1KB and 1KiB both yield 1024. This processor does not follow the SI convention where KB would be 1000 bytes; use Data Size where the distinction matters, which reads decimal and binary units separately.

Fractional values such as 1.5KB are supported, and whitespace around the number and unit is ignored. A string that does not match the number-and-unit shape raises invalid byte size format.

Examples

Basic

Convert size with byte units...	{ "file_size": "1.5KB" } - bytes: field: file.size
to its value in bytes:	{ "file.size": 1536 }

Unit Variations

The processor handles various unit formats and cases...	{ "sizes": { "a": "1kb", "b": "1KB", "c": "1 KB", "d": "1 Kb", "e": "1KiB" } } - bytes: field: sizes.a - bytes: field: sizes.b - bytes: field: sizes.c - bytes: field: sizes.d - bytes: field: sizes.e
all converting to the same value — the IEC spelling included, since every prefix is 1024-based either way:	{ "sizes": { "a": 1024, "b": 1024, "c": 1024, "d": 1024, "e": 1024 } }

Keep Original

Store the result in a different field...	{ "raw_size": "1GB" } - bytes: field: raw_size target_field: size_in_bytes
keeping the original value:	{ "raw_size": "1GB", "size_in_bytes": 1073741824 }

Error Handling

With invalid formats...	{ "size": "100XB" } - bytes: field: size ignore_failure: true
errors can be ignored:	{ "size": "100XB", "error": { "message": "Invalid byte unit format" } }

Missing Fields

When field is missing...	{ "other_field": "value" } - bytes: field: size ignore_missing: true
processing continues if configured:	{ "other_field": "value" }