# Conditionals not working on numeric fields

**URL:** <https://discuss.elastic.co/t/conditionals-not-working-on-numeric-fields/116426>\
**Category:** Logstash\
**Created:** [January 22, 2018, 4:42am UTC](https://discuss.elastic.co/t/conditionals-not-working-on-numeric-fields/116426 "2018-01-22T04:42:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [January 22, 2018, 4:42am UTC](https://discuss.elastic.co/t/conditionals-not-working-on-numeric-fields/116426/1 "2018-01-22T04:42:02Z")

</div>

Hi,

I'm having an issue with conditionals and numeric fields. The config below only works if I first convert my fields to a string.

I found a blog that mentions `if ([foo]) { ... }` should work for numeric fields but

```auto
  if ([netflow][l4_src_port]) == "8888" {
     drop { }
  }
```

does not (logstash trows an error). I couldn't find anything in the Docs either.

What is the correct way to handle numeric fields and conditionals?

```auto
filter {
  if [type] == "netflow" {

   if ![netflow][ipv4_src_addr] {
     drop { }
  }

  mutate {
     convert => { "[netflow][l4_src_port]" => "string" }
     convert => { "[netflow][l4_dst_port]" => "string" }
  }

  if [netflow][l4_src_port] == "8888" {
     drop { }
  }

  if [netflow][l4_dst_port] == "8888" {
     drop { }
  }

  if [netflow][l4_src_port] == "9993" {
     drop { }
  }

  if [netflow][l4_dst_port] == "9993" {
     drop { }
  }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 22, 2018, 9:20pm UTC](https://discuss.elastic.co/t/conditionals-not-working-on-numeric-fields/116426/2 "2018-01-22T21:20:58Z")

</div>

For numerical comparisons don't double-quote the operand, i.e. say `8888` instead of `"8888"`.

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [January 24, 2018, 9:04am UTC](https://discuss.elastic.co/t/conditionals-not-working-on-numeric-fields/116426/3 "2018-01-24T09:04:51Z")

</div>

Thanks as always. I will try that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2018, 9:05am UTC](https://discuss.elastic.co/t/conditionals-not-working-on-numeric-fields/116426/4 "2018-02-21T09:05:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.