# Add field if based on another timestamps-field value
**URL:** https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985
**Category:** Logstash
**Created:** [October 18, 2021, 11:43am UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985 "2021-10-18T11:43:04Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Cibot](https://discuss.elastic.co/u/Cibot)
#### Post date: [October 18, 2021, 11:43am UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985/1 "2021-10-18T11:43:04Z")
I've been trying to add a field describing the status of the current rpm.
Basically I've been using execbeats to execute a command which returns all the currently installed rpms.
Now we have an internal tool which basically builds all rpms daily. So we can assume, if an RPM is older than last day 19:00, it is out of date.
Currently I'm already extracting the timestamp as a seperate STRING field.
It has the format of YYMMddHH ... so 21101819 as an example. Now the idea would be to do something like
```auto
[rpmtimestamp] >= "%{+YYMMdd}-{1 day}19"
```
Now I think there are 2 issues with this, first \>= is probably not supported for strings as I get some huge error. Secondly, I don't know how I would implement (-1 day). Since you also have to consider end of month and such. (well technically I don't think you need to, if string comparison actually worked) I have seen a few suggestions with ruby, but I don't think it looks that readable so I was trying to get it to work like this. Is it possible? (Possibly with Int / string conversions)
---
### Author:  [@Cibot](https://discuss.elastic.co/u/Cibot)
#### Post date: [October 18, 2021, 12:14pm UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985/2 "2021-10-18T12:14:42Z")
I found this regarding this problem: [Add index pattern / date math support to the index =\> setting · Issue #49 · logstash-plugins/logstash-input-elasticsearch · GitHub](https://github.com/logstash-plugins/logstash-input-elasticsearch/issues/49)
Unfortunately this doesn't seem to be supported outside of index names.
As I still get something like this in my debugging: out of date - \<{now/d-1d{YYMMdd}}\>19
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [October 18, 2021, 5:44pm UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985/3 "2021-10-18T17:44:08Z")
No, logstash does not include date maths. But you can use a ruby filter
```
mutate { add_field => { "rpmtimestamp" => "21101813" } }
date { match => ["rpmtimestamp", "YYMMddHH"] target => "[@metadata][rpmtimestamp]" }
ruby { code => 'event.set("rpmstatus", DateTime.now.strftime("%s").to_i - event.get("[@metadata][rpmtimestamp]").to_i > 86400 ? "old" : "new")' }
```
That is not very readable, and includes no error handling, so you will need to rewrite it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 15, 2021, 5:44pm UTC](https://discuss.elastic.co/t/add-field-if-based-on-another-timestamps-field-value/286985/4 "2021-11-15T17:44:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.