# Compare fields in Logstash ruby filter

**URL:** <https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874>\
**Category:** Logstash\
**Created:** [September 6, 2016, 10:48am UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874 "2016-09-06T10:48:41Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurveer\_Singh](https://avatars.discourse-cdn.com/v4/letter/g/f6c823/32.png) [@Gurveer\_Singh](https://discuss.elastic.co/u/Gurveer_Singh)\
**Post date:** [September 6, 2016, 10:48am UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/1 "2016-09-06T10:48:41Z")

</div>

I trying following ruby code, but doesn't working for me. Can somebody help me where I am doing wrong ?

ruby {  
code =\> '  
require "csv"  
records = CSV.foreach("/path/to/file.csv")  
records.each do |rec|  
if rec[0] == event["#{Hostname}"] and rec[1] == event["#{Serial\_Number}"]  
event["Updated\_Status"] = EXCEPTION  
end  
end  
'  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2016, 10:53am UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/2 "2016-09-06T10:53:16Z")

</div>

What is `event["#{Hostname}"]` supposed to mean? If you want to obtain the current contents of the `Hostname` field you're looking for `event["Hostname"]`.

---

<div class="post-metadata">

**Author:** ![Gurveer\_Singh](https://avatars.discourse-cdn.com/v4/letter/g/f6c823/32.png) [@Gurveer\_Singh](https://discuss.elastic.co/u/Gurveer_Singh)\
**Post date:** [September 6, 2016, 11:39am UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/3 "2016-09-06T11:39:00Z")

</div>

I am parsing a CSV file which has field name "Hostname", so I want to use same field Hostname content in ruby filter for comparison.

```
ruby {
          code => '
          require "csv"
          records = CSV.foreach("/root/CIS/filter.csv")
          records.each do |rec|
            if rec[0] == event["Hostname"] and rec[1] == event["Serial_Number"]
              event["Updated_Status"] = EXCEPTION
            end
          end
          '
        }

```

If I use above code as you mentioned i am getting following error while executing.

**Ruby exception occurred: closed stream {:level=\>:error}**

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2016, 11:54am UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/4 "2016-09-06T11:54:04Z")

</div>

Try

```nohighlight
CSV.foreach("/root/CIS/filter.csv") do |rec|

```

instead of

```nohighlight
records = CSV.foreach("/root/CIS/filter.csv")
records.each do |rec|

```

---

<div class="post-metadata">

**Author:** ![Gurveer\_Singh](https://avatars.discourse-cdn.com/v4/letter/g/f6c823/32.png) [@Gurveer\_Singh](https://discuss.elastic.co/u/Gurveer_Singh)\
**Post date:** [September 6, 2016, 12:24pm UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/5 "2016-09-06T12:24:48Z")

</div>

I tried this code.

```
> ruby {
> code => '
> require "csv"
> CSV.foreach("/root/CIS/filter.csv") do |rec|
> if rec[0] == event["Hostname"] and rec[1] == event["Serial_Number"]
> event["Updated_Status"] = EXCEPTION
> end
> end
> '
> }

```

It's not stuck as previous but where condition match, logstash add following.

```
"tags" => [
        [0] "_rubyexception"
    ]

```

And shows following error too.  
**Ruby exception occurred: uninitialized constant LogStash::Filters::Ruby::EXCEPTION {:level=\>:error}**

Values which I am comparing are String.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2016, 12:46pm UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/6 "2016-09-06T12:46:06Z")

</div>

And what's that EXCEPTION in your code supposed to mean? If it's a string you need to double-quote it.

---

<div class="post-metadata">

**Author:** ![Gurveer\_Singh](https://avatars.discourse-cdn.com/v4/letter/g/f6c823/32.png) [@Gurveer\_Singh](https://discuss.elastic.co/u/Gurveer_Singh)\
**Post date:** [September 6, 2016, 1:25pm UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/7 "2016-09-06T13:25:49Z")

</div>

If condition match then ruby code will add a field Updated\_Status with value EXCEPTION.

```
if rec[0] == "event["Hostname"]" and rec[1] == "event["Serial_Number"]"
              event["Updated_Status"] = EXCEPTION
            end

```

If I am using double-quote, then logstash shows following error.

```
SyntaxError: (ruby filter code):4: syntax error, unexpected tCONSTANT
            if rec[0] == "event["Hostname"]" and rec[1] == "event["Serial_Number"]"
                                    ^

```

I guess there is some different way to compare string values in ruby filter.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 6, 2016, 1:31pm UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/8 "2016-09-06T13:31:33Z")

</div>

Double-quote EXCEPTION, nothing else.

```
event["Updated_Status"] = "EXCEPTION"
```

---

<div class="post-metadata">

**Author:** ![Gurveer\_Singh](https://avatars.discourse-cdn.com/v4/letter/g/f6c823/32.png) [@Gurveer\_Singh](https://discuss.elastic.co/u/Gurveer_Singh)\
**Post date:** [September 6, 2016, 1:54pm UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/9 "2016-09-06T13:54:28Z")

</div>

Thanks Magnus, It works for me. Thanks alot. You solved my really big issue.

Final Code:

```
ruby {
          code => '
          require "csv"
          CSV.foreach("/root/CIS/filter.csv") do |rec|
            if rec[0] == event["Hostname"] and rec[1] == event["Serial_Number"]
              event["Updated_Status"] = "EXCEPTION"
            end
          end
          '
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/compare-fields-in-logstash-ruby-filter/59874/10 "2017-07-06T04:39:40Z")

</div>