# How to compare double type filed in logstash output
**URL:** https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519
**Category:** Logstash
**Created:** [July 27, 2016, 12:39pm UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519 "2016-07-27T12:39:00Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)
#### Post date: [July 27, 2016, 12:39pm UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/1 "2016-07-27T12:39:00Z")
I want to compare two fields both are double type which I checked using this url
[http://localhost:9200/logstash-\*/\_mapping?pretty](http://localhost:9200/logstash-*/_mapping?pretty)
and I wrote like this in my logstash config file
if [field1] \> [field2]
{
email {
from =\> "testmail"
subject =\> "logstash alert"
to =\> "testmail"
via =\> "smtp"
body =\> "This is new vandanatest for new condition %{field1}"
}
}
if i send mail without if condition I always receive an email but never enters into this condition ,this condition is true I check manually . Is there any syntactical error in this ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 27, 2016, 1:02pm UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/2 "2016-07-27T13:02:26Z")
The fields might be mapped as float fields in Elasticsearch, but are they float fields in the Logstash event? Please show the result of a `stdout { codec => rubydebug }` output for an event that didn't trigger an email.
(Side note: I do not recommend using Logstash for alerting like this.)
---
### Author:  [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)
#### Post date: [July 28, 2016, 5:46am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/3 "2016-07-28T05:46:41Z")
hello I am getting this error when I use \> this event
NoMethodError: undefined method `\>' for nil:NilClass but without this event sample output is here
{
"message" =\> "connected\_slaves:0\r",
"@version" =\> "1",
"@timestamp" =\> "2016-07-28T05:27:43.687Z",
"type" =\> "replication",
"host" =\> "N11DTHDM0008",
"command" =\> "redis-cli info replication",
"connected\_slaves" =\> 0.0
}
{
"message" =\> "master\_repl\_offset:0\r",
"@version" =\> "1",
"@timestamp" =\> "2016-07-28T05:27:43.687Z",
"type" =\> "replication",
"host" =\> "N11DTHDM0008",
"command" =\> "redis-cli info replication",
"master\_repl\_offset" =\> 0.0
}
{
"message" =\> "used\_cpu\_sys:0.51\r",
"@version" =\> "1",
"@timestamp" =\> "2016-07-28T05:27:43.673Z",
"type" =\> "cpu",
"host" =\> "N11DTHDM0008",
"command" =\> "redis-cli info cpu",
"used\_cpu\_sys" =\> 0.51
}
And can you please explain why alerting is not recommendable as I don't know much about that
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 28, 2016, 8:19am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/4 "2016-07-28T08:19:45Z")
> hello I am getting this error when I use \> this event
> NoMethodError: undefined method `\>' for nil:NilClass
That probably means that the field you're trying to compare with something doesn't exist.
> but without this event sample output is here
Assuming `connected_slaves`, `master_repl_offset`, and `used_cpu_sys` are the fields you're referencing in your conditional things are looking good.
> And can you please explain why alerting is not recommendable as I don't know much about that
Logstash isn't an alerting system so it lacks features that real alerting systems have. For example, it won't send you a single message when a threshold has been met (so unless you're careful it'll flood you with messages), there's no way to silence alerts, etc.
---
### Author:  [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)
#### Post date: [July 28, 2016, 8:33am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/5 "2016-07-28T08:33:20Z")
But I can see the fields in kibana under available fields have a look on my config
```
input {
exec {
command => "redis-cli info clients"
interval => 4
type => "clients"
}
exec {
command => "cat /proc/meminfo"
type => "sysmem"
interval => 4
}
exec {
command => "redis-cli info memory"
interval => 4
type => "memory"
}
exec {
command => "redis-cli info cpu"
interval => 4
type => "cpu"
}
exec {
command => "redis-cli info stats"
interval => 4
type => "stats"
}
exec {
command => "redis-cli info replication"
interval => 4
type => "replication"
}
}
filter {
split {
}
ruby {
code => "fields = event['message'].split(':')
event[fields[0]] = fields[1].to_f
"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
if [MemFree] and [used_memory_human]
{
if [MemFree] > [used_memory_human]
{
}
}
stdout { codec => rubydebug}
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 28, 2016, 8:36am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/6 "2016-07-28T08:36:04Z")
What does an event with the `MemFree` and `used_memory_human` fields look like? Do those fields actually exist in the same event?
---
### Author:  [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)
#### Post date: [July 28, 2016, 8:40am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/7 "2016-07-28T08:40:09Z")
No these fields are generated because of redis commands basically I want to compare redis memory and system memory
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 28, 2016, 8:44am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/8 "2016-07-28T08:44:33Z")
How they're generated matters less. What does matter is that Logstash can't compare fields in different events. Each event is processed by the filters independently from other events. There are a few filters that make exceptions to this general rule and you _might_ be able to use the aggregate filter to do what you need, but then I think you'd be bending Logstash too far.
If you're sending all the data to Elasticsearch a better approach would be to write a script that queries ES for the latest metric of each kind and makes the comparison. I believe the Watcher product would be capable of this.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/how-to-compare-double-type-filed-in-logstash-output/56519/9 "2017-07-06T04:46:09Z")