# Evaluating range of values using ES|QL

**URL:** <https://discuss.elastic.co/t/evaluating-range-of-values-using-es-ql/364418>\
**Category:** Kibana\
**Created:** [August 5, 2024, 8:37pm UTC](https://discuss.elastic.co/t/evaluating-range-of-values-using-es-ql/364418 "2024-08-05T20:37:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nama\_Chintamani\_Illo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nama_chintamani_illo/32/123100_2.png) [@Nama\_Chintamani\_Illo](https://discuss.elastic.co/u/Nama_Chintamani_Illo)\
**Post date:** [August 5, 2024, 8:37pm UTC](https://discuss.elastic.co/t/evaluating-range-of-values-using-es-ql/364418/1 "2024-08-05T20:37:09Z")

</div>

I was wondering if anyone might want to take a stab at this one. I have an ES|QL query I'm trying to get to work. Right now I'm able to get the field "http.status" to "not equal" a value of "200":

```auto
| eval failures = case(http.status != "200",1,0)

```

What I am struggling with is how to to get the field "http.status" to "not equal" a value from "200 to 299". Both of these I have tried and can't get to work:

```auto
| eval failures = case(http.status != ("200-299"),1,0)

```

```auto
| eval failures = case(http.status >= "200" && http.status <= "299",1,0)

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 6, 2024, 2:35am UTC](https://discuss.elastic.co/t/evaluating-range-of-values-using-es-ql/364418/2 "2024-08-06T02:35:26Z")

</div>

Hi @Nama_Chintamani_Illo

So if these values are numeric this should work

```auto
from traces-apm-default
| where http.response.status_code is not null
| eval success = case(http.response.status_code >= 200 and http.response.status_code < 400, 1,0)
| keep @timestamp, http.response.status_code, success

```

If they are keyword you will need to convert to integer something like this

```auto
from traces-apm-default
| where labels.http_status_code is not null
| eval status_num = to_integer(labels.http_status_code)
| eval success = case(status_num >= 200 and status_num <= 400, 1,0)
| keep @timestamp, labels.http_status_code, success

```