# Compare two fields

**URL:** https://discuss.elastic.co/t/compare-two-fields/110088
**Category:** Logstash
**Created:** [December 4, 2017, 4:45am UTC](https://discuss.elastic.co/t/compare-two-fields/110088 "2017-12-04T04:45:18Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![pope843](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@pope843](https://discuss.elastic.co/u/pope843)
#### Post date: [December 4, 2017, 4:45am UTC](https://discuss.elastic.co/t/compare-two-fields/110088/1 "2017-12-04T04:45:18Z")

</div>

Hello Guys,

Just want to know if below condition will work or possible?

filter {  
ruby {  
code =\> "  
event.set('dateko', Time.now.strftime('%Y-%m-%d'))  
"  
}  
if [dateko] not in [message] {  
.......  
}  
}

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2017, 6:24am UTC](https://discuss.elastic.co/t/compare-two-fields/110088/2 "2017-12-04T06:24:04Z")

</div>

Syntax-wise that looks fine. Why ask when you can try it out?

---

<div class="post-metadata">

### Author: ![pope843](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@pope843](https://discuss.elastic.co/u/pope843)
#### Post date: [December 4, 2017, 6:29am UTC](https://discuss.elastic.co/t/compare-two-fields/110088/3 "2017-12-04T06:29:17Z")

</div>

thanks Magnus, sorry i have a running config in production. just want to add that condition. I've tested it now and it seemed to work. Also it's available on the docu online

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)

Btw, I have this ruby code

```
	ruby {
		code => "
		event.set('datemo', DateTime.yesterday.strftime('%Y-%m-%d'))
		"
	 }

```

But i've encountered this error on logstash logs, could you help me pls what was wrong here.

[2017-12-04T06:20:50,922][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `yesterday' for DateTime:Class [2017-12-04T06:20:50,926][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method`yesterday' for DateTime:Class  
[2017-12-04T06:20:50,927][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `yesterday' for DateTime:Class [2017-12-04T06:20:50,928][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method`yesterday' for DateTime:Class  
[2017-12-04T06:20:50,929][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `yesterday' for DateTime:Class [2017-12-04T06:20:50,931][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method`yesterday' for DateTime:Class  
[2017-12-04T06:20:50,934][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `yesterday' for DateTime:Class

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 4, 2017, 7:06am UTC](https://discuss.elastic.co/t/compare-two-fields/110088/4 "2017-12-04T07:06:53Z")

</div>

> sorry i have a running config in production. just want to add that condition.

You need to have a usable test environment.

> Ruby exception occurred: undefined method `yesterday' for DateTime:Class

Well, the standard DateTime class doesn't have a `yesterday` method. I don't know Ruby well enough to give a good countersuggestion.

---

<div class="post-metadata">

### Author: ![pope843](https://avatars.discourse-cdn.com/v4/letter/p/f4b2a3/32.png) [@pope843](https://discuss.elastic.co/u/pope843)
#### Post date: [December 4, 2017, 7:23am UTC](https://discuss.elastic.co/t/compare-two-fields/110088/5 "2017-12-04T07:23:35Z")

</div>

thanks magnus for the advise. yes i'll set a test env for this.

this one is working to get the current date.

```
          ruby {
          code => "
          event.set('dateko', Time.now.strftime('%Y-%m-%d'))
          "
          } 

```

this one is not for yesterday's date

```
        ruby {
	code => "
	event.set('datemo', DateTime.yesterday.strftime('%Y-%m-%d'))
	"
        }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2018, 7:23am UTC](https://discuss.elastic.co/t/compare-two-fields/110088/6 "2018-01-01T07:23:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
