# How to check column quantity in a filter?

**URL:** <https://discuss.elastic.co/t/how-to-check-column-quantity-in-a-filter/126757>\
**Category:** Logstash\
**Created:** [April 4, 2018, 2:21pm UTC](https://discuss.elastic.co/t/how-to-check-column-quantity-in-a-filter/126757 "2018-04-04T14:21:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanV](https://avatars.discourse-cdn.com/v4/letter/d/e9c0ed/32.png) [@DanV](https://discuss.elastic.co/u/DanV)\
**Post date:** [April 4, 2018, 2:22pm UTC](https://discuss.elastic.co/t/how-to-check-column-quantity-in-a-filter/126757/1 "2018-04-04T14:22:00Z")

</div>

Hello,

I'm receiving logs from a firewall and i want to sort the different types of logs based on the quantity of columns (columns created using cvs with autogenerate on) they have, instead of doing it based on the column values. Something like:

```
                          if number_of_columns == 30:
                                                do this because it's the type of log that has 30 columns

```

Is there some kind of way to do this?

Thanks!

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [April 4, 2018, 2:55pm UTC](https://discuss.elastic.co/t/how-to-check-column-quantity-in-a-filter/126757/2 "2018-04-04T14:55:36Z")

</div>

Is this what you want?

```
ruby {
    code => "event.set('[@metadata][colcount]',event.to_hash.length)"
 }
```

---

<div class="post-metadata">

**Author:** ![DanV](https://avatars.discourse-cdn.com/v4/letter/d/e9c0ed/32.png) [@DanV](https://discuss.elastic.co/u/DanV)\
**Post date:** [April 5, 2018, 12:58pm UTC](https://discuss.elastic.co/t/how-to-check-column-quantity-in-a-filter/126757/3 "2018-04-05T12:58:31Z")

</div>

Yes, thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2018, 12:58pm UTC](https://discuss.elastic.co/t/how-to-check-column-quantity-in-a-filter/126757/4 "2018-05-03T12:58:33Z")

</div>

Closed on May 3, 2018, 12:58pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.