# Filtering Fields whose values are negative

**URL:** <https://discuss.elastic.co/t/filtering-fields-whose-values-are-negative/120688>\
**Category:** Logstash\
**Created:** [February 20, 2018, 4:58pm UTC](https://discuss.elastic.co/t/filtering-fields-whose-values-are-negative/120688 "2018-02-20T16:58:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![govinda.rao](https://avatars.discourse-cdn.com/v4/letter/g/f14d63/32.png) [@govinda.rao](https://discuss.elastic.co/u/govinda.rao)\
**Post date:** [February 20, 2018, 4:58pm UTC](https://discuss.elastic.co/t/filtering-fields-whose-values-are-negative/120688/1 "2018-02-20T16:58:29Z")

</div>

Hi,

I need a help on filtering the negative values in below logstash IF condition. Below code calculates the elapsed time. Some times i used to get the negative values for elapsed\_time. How can i filter those negative values of elapsed\_time while sending to output to elasticsearch in Output section.

```
 grok {
      match => {"message" => "^%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{INT:serviceno:NUMBER} --- %{DATA:service_type} : %{WORD:process_state} %{GREEDYDATA:data}"}
      add_tag => ["%{process_state}"]
    }
 date {
      match => ["timestamp", "ISO8601"]
    }

 elapsed {
      unique_id_field => "serviceno"
      start_tag => "Initiating"
      end_tag => "EventThread"
      new_event_on_match => true
      add_tag => ["gip"]
    }

 if "gip" in [tags] and "elapsed" in [tags] {
     aggregate {
          task_id => "%{serviceno}"
          code => "map['report'] = [(process_state['elapsed_time']*1000).to_i]"
          map_action => "update"
          end_of_task => true
        }
    }

```

}  
output {  
elasticsearch {  
hosts =\> ["hostname"]  
index =\> "index\_name"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2018, 4:59pm UTC](https://discuss.elastic.co/t/filtering-fields-whose-values-are-negative/120688/2 "2018-03-20T16:59:48Z")

</div>

Closed on March 20, 2018, 4:59pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.