# Condition check

**URL:** <https://discuss.elastic.co/t/condition-check/148584>\
**Category:** Logstash\
**Created:** [September 14, 2018, 8:47am UTC](https://discuss.elastic.co/t/condition-check/148584 "2018-09-14T08:47:59Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [September 14, 2018, 8:47am UTC](https://discuss.elastic.co/t/condition-check/148584/1 "2018-09-14T08:47:59Z")

</div>

I have a field name errorcode which is of type NUMBER. How do i check the starting first digit of errorcode and place it as a ciondition in if statement.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 14, 2018, 6:12pm UTC](https://discuss.elastic.co/t/condition-check/148584/2 "2018-09-14T18:12:38Z")

</div>

Regular expressions, supported in conditionals, are good at checking against patterns but only work against `STRING`s; the following will add a metadata field that is a string representation of `errorcode`, then use it in the if clause.

```auto
if [errorcode]
  mutate {
    add_field => {
      "[@metadata][error_code_string]" => "%{errorcode}"
    }
  }
  if [@metadata][error_code_string] =~ /^7/ {
    # ... this will only be executed if the `errorcode` starts with 7.
  }
}

```

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [September 18, 2018, 7:57am UTC](https://discuss.elastic.co/t/condition-check/148584/3 "2018-09-18T07:57:39Z")

</div>

are you missing a { somewhere?

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [September 18, 2018, 8:08am UTC](https://discuss.elastic.co/t/condition-check/148584/4 "2018-09-18T08:08:58Z")

</div>

So, if it is any other variable type than string,a direct condition check cant be done. It has to be converted to string first.

---

<div class="post-metadata">

**Author:** ![Arun\_Murugappan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arun_murugappan/32/101630_2.png) [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\
**Post date:** [September 18, 2018, 8:19am UTC](https://discuss.elastic.co/t/condition-check/148584/5 "2018-09-18T08:19:10Z")

</div>

Just to check  
**=~** meaning contains  
**/^7/** meaning starting with 7  
**%{errorcode}** meaning string type of errorcode

what if i want to check ending with 7, is it **/$7/** or what if it is just has to contain 7 in any part, is it **/7/**?

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 19, 2018, 11:45pm UTC](https://discuss.elastic.co/t/condition-check/148584/6 "2018-09-19T23:45:45Z")

</div>

to clarify:

- `=~` means "matches the following regular expression"
- `/^7/` is a regular expression.
  - `^` in regular expressions, the up-carat is a beginning-of-line matcher
  - so `/^7/` means "a sequence of characters that starts with 7"

- `%{errorcode}` is used inside a sprintf format string as a part of `add_field`; when executed, it substitutes the _value of_ the `errorcode` field. This is the method I used to convert the integer to string.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [September 19, 2018, 11:47pm UTC](https://discuss.elastic.co/t/condition-check/148584/7 "2018-09-19T23:47:23Z")

</div>

- a regular expression that matches any string ending with 7 would be `/7$`, since the dollar symbol in regular expressions means end-of-line.
- a regular expression matching _any_ string that contains a 7 would be `/7/`.

More can be learned about regular expressions at [http://regular-expressions.info/](http://regular-expressions.info/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2018, 11:52pm UTC](https://discuss.elastic.co/t/condition-check/148584/8 "2018-10-17T23:52:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.