# Annoying - filter ruby code multiplication doesnt work
**URL:** https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187
**Category:** Logstash
**Created:** [June 8, 2016, 9:45am UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187 "2016-06-08T09:45:29Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)
#### Post date: [June 8, 2016, 9:45am UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187/1 "2016-06-08T09:45:29Z")
Can anyone please help with this ... its annoying me no end 🙂
field cpu.user\_p=0.45
This filter works and allocates cpu\_user\_p=45
ruby
{ code =\> "event['cpu\_user\_p'] = 0.45 \* 100" }
This filter doesnt work, and cpu\_user\_p=0
ruby
{ code =\> "event['cpu\_system\_p'] = event['cpu.user\_p'].to\_f \* 100" }
---
### Author:  [@purbon](https://discuss.elastic.co/u/purbon)
#### Post date: [June 8, 2016, 2:19pm UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187/2 "2016-06-08T14:19:07Z")
which version of logstash are you using? this, including your full configuration will be required to know more about your problem, I just did a quick check and
```auto
skywalker% ./logstash-2.3.0/bin/logstash -f ruby.conf
Settings: Default pipeline workers: 4
Pipeline main started
{
"cpu_user_p" => 45.0,
"message" => "Hello world!",
"@timestamp" => 2016-06-08T14:24:29.149Z,
"host" => "skywalker",
"sequence" => 0,
"@version" => "1"
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}
skywalker%
```
this is what you get with
```auto
input {
generator { count => 1}
}
filter {
ruby {
code => "event['cpu_user_p'] = 0.45 * 100"
}
}
output {
stdout { codec => rubydebug }
}
```
is your issue because in your first code you use `cpu_user_p` while in the second you use `'cpu.user_p` see the dot after cpu vs the underscore in the first part.
---
### Author:  [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)
#### Post date: [June 8, 2016, 6:10pm UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187/3 "2016-06-08T18:10:39Z")
Hi Pere,
Thanks for the reply.
Top beat event['cpu.user\_p'] (with a dot gives a percentage as a decimal it uses 0.01 to represent 1%
I want to multiply it by 100 so that it is a true percentage. If I can retain the field name of cpu.user\_p then so much the better. Thought it safer to change the . to an \_ while I test it so that I can see both versions. So the intention was that the new true percentage would be called cpu\_user\_p
Seems to work OK as your program below. However when using it with input from topbeat cpu\_user\_p is always 0, and I cant understand why. I thought that using to\_f would cast it to a float in logstash if it was not already if that type ?
The logstash version is 2.2.2
This file:
input {
generator { count =\> 1}
}
filter {
mutate {
add\_field =\> { "cpu.user\_p" =\> 0.05 }
}
ruby {
code =\> "event['cpu\_user\_p'] = event['cpu.user\_p'].to\_f \* 100"
}
}
output {
stdout { codec =\> rubydebug }
}
gives an output as below(i.e. working) But this doent work when the input cpu.user\_p comes from topbeat and =0.05.
Settings: Default pipeline workers: 2
Logstash startup completed
{
"message" =\> "Hello world!",
"@version" =\> "1",
"@timestamp" =\> "2016-06-08T17:57:27.216Z",
"host" =\> "servername",
"sequence" =\> 0,
"cpu.user\_p" =\> "0.05",
"cpu\_user\_p" =\> 5.0
}
Logstash shutdown completed
---
### Author:  [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)
#### Post date: [June 8, 2016, 9:01pm UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187/4 "2016-06-08T21:01:53Z")
I think that the issue might be that cpu.user\_p is part of a JSON document as shown below.
So when I try to reference cpu.user\_p in logstash I'm guessing it doesnt recognise it as the name of a field as such ?
How would I change cpu.user\_p from float like 0.07 to 7 i.e. multiply by 100 if it is part of a JSON document ?
Any help with this much appreciated.
Thanks
Mick
{
"\_index": "logstashsystem-2016.06.08",
"\_type": "system",
"\_id": "AVUxwZ29nE6fvOfjobS-",
"\_score": null,
"\_source": {
"@timestamp": "2016-06-08T20:43:39.209Z",
"beat": {
"hostname": "servername",
"name": "servername"
},
"cpu": {
"idle": 359180971,
"iowait": 211944,
"irq": 91,
"nice": 54369,
"softirq": 33274,
"steal": 0,
"system": 2280639,
"system\_p": 0.0045,
"user": 4354223,
"user\_p": 0.011
},
"load": {
"load1": 0.03,
"load15": 0.02,
"load5": 0.06
},
"mem": {
"actual\_free": 7773220864,
"actual\_used": 478752768,
"actual\_used\_p": 0.06,
"free": 3124805632,
"total": 8251973632,
"used": 5127168000,
"used\_p": 0.62
},
"swap": {
"free": 2147479552,
"total": 2147479552,
"used": 0,
"used\_p": 0
},
---
### Author:  [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)
#### Post date: [June 9, 2016, 9:37am UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187/5 "2016-06-09T09:37:34Z")
Have re-raised this as per below link as I understand the issue more now
> [@Issue changing value of JSON field in logstash](https://discuss.elastic.co/t/issue-changing-value-of-json-field-in-logstash/52309):
>
> Hi, I'm trying to change a value in logstash of JSON which has been generated by Topbeat Below are the input file name, the logstash filter, and the error that I am getting Can anyone spot why I'm getting the error please ? Very Much appreciated, Mick JSON input file { "\_index": "logstashsystem-2016.06.08", "\_type": "system", "\_id": "AVUxwZ29nE6fvOfjobS-", "\_score": null, "\_source": { "@timestamp": "2016-06-08T20:43:39.209Z", "beat": { "hostname": "serverName", "name": "serverName…
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/annoying-filter-ruby-code-multiplication-doesnt-work/52187/6 "2017-07-06T04:53:54Z")