# Compare float value generated from Glok Pattern

**URL:** <https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616>\
**Category:** Logstash\
**Created:** [August 17, 2021, 1:07am UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616 "2021-08-17T01:07:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Athul\_Devkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/athul_devkar/32/93241_2.png) [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\
**Post date:** [August 17, 2021, 1:07am UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616/1 "2021-08-17T01:07:45Z")

</div>

Dear All,

I am trying to compare 2 float fields, which are created from Grok patterns match.

But this is crashing the pipeline. Not able to figure out what is missing here! Kindly help.

```auto
if [message] =~ "Customer Type : data" {
    grok {
        match => {"message" => AccountNumber : %{NUMBER:AcctNumber}, Title Role: %{DATA:TitleRole}, Customer Type : %{DATA:CustomerType}, Source Type : %{DATA:SourceType}, **TotalMrc : %{NUMBER:TotalMRC:float}, NMrc : %{NUMBER:NMRC:float}** ,}
    }
    }
    if [TotalMRC] > [NMrc] {
	 mutate {
        add_field => {"TEST" => "YES"}
    }}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 17, 2021, 1:14am UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616/2 "2021-08-17T01:14:25Z")

</div>

You need to have quotes around your grok pattern, and the numeric comparison can crash things if those fields do not exist, so you should test for that using

```
if [TotalMRC] and [NMrc] {
    if [TotalMRC] > [NMrc] {
```

---

<div class="post-metadata">

**Author:** ![Athul\_Devkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/athul_devkar/32/93241_2.png) [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\
**Post date:** [August 17, 2021, 1:56pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616/3 "2021-08-17T13:56:35Z")

</div>

Thanks for your reply.

The Quotes around Grok - I just missed that while copy pasting here.

However, added the null check as you recommended. Its not crashing now. Which is good thing. But Still don't see the field getting created, no errors in logs. Anything else I am missing?

```auto
match => {"message" => "Automation Type : %{DATA:AutomationTypeValue},ExistingTotalMrc : %{NUMBER:ExistingTotalMRC:float}, NewTotalMrc : %{NUMBER:NewTotalMRC:float}, %{GREEDYDATA:Greedymessage}"} 

if [ExistingTotalMRC] and [NewTotalMrc] {
     if [NewTotalMrc] > [ExistingTotalMRC] {
        mutate {
            add_field => {"SaleTrend" => "Upsell"}
        }
     } 
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 17, 2021, 2:27pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616/4 "2021-08-17T14:27:59Z")

</div>

> [@Athul\_Devkar](#):
>
> `if [ExistingTotalMRC] and [NewTotalMrc] {`

Your grok pattern creates NewTotalMRC, not NewTotalMrc.

---

<div class="post-metadata">

**Author:** ![Athul\_Devkar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/athul_devkar/32/93241_2.png) [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\
**Post date:** [August 17, 2021, 2:38pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616/5 "2021-08-17T14:38:26Z")

</div>

ahhh. My bad. It works now.

Sorry about the trouble! New to these stuffs.

Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2021, 2:38pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616/6 "2021-09-14T14:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.