title: What is the last part in the grok match pattern?
body: <p>I've noticed some people use the 3rd part in a grok matching predicate, like</p>
  
  <pre><code>%{NUMBER:response_status:int}
                            ^--- ??
  </code></pre>
  
  <p>It's obvious what first 2 mean, and I can guess that the 3rd one is an explicit type of the result, but I cannot find the comprehensive explanation of what that 3rd part is.</p>
  
  <p>I checked in both <a href="http://logstash.net/docs/1.4.2/filters/grok" rel="nofollow">Logstash documentation</a> and in <a href="https://code.google.com/p/semicomplete/wiki/Grok" rel="nofollow">Grok's one</a> and cannot see any traces of the comprehensive syntax description.</p>
  
  <p>Any references?</p>
  
  <p><strong>UPD</strong>:</p>
  
  <p>here is an example that it works and is syntactically correct:</p>
  
  <p>For the config file:</p>
  
  <pre><code>input { stdin { } }
  
  filter {
      grok {
          match =&gt; [
              "message", "%{NUMBER:a_number:float}"
          ]
      }
  }
  
  output { stdout { codec =&gt; rubydebug } }
  </code></pre>
  
  <p>The output for the <code>12345</code> is:</p>
  
  <pre><code>{
     "message" =&gt; "12345",
    "@version" =&gt; "1",
  "@timestamp" =&gt; "2014-10-08T01:08:49.087Z",
        "host" =&gt; "logstash",
    "a_number" =&gt; 12345.0
  }
  </code></pre>
  
  <p>If you remove <code>:float</code> then it changes to</p>
  
  <pre><code>{
     "message" =&gt; "12345",
    "@version" =&gt; "1",
  "@timestamp" =&gt; "2014-10-08T01:09:46.055Z",
        "host" =&gt; "logstash",
    "a_number" =&gt; "12345"
  }
  </code></pre>
  
  <p>This is true for at least logstash v1.4.2</p>