# How to compare the current event with the previous 2 events in logstash?
**URL:** https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864
**Category:** Logstash
**Created:** [September 24, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864 "2020-09-24T18:03:17Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@subash](https://discuss.elastic.co/u/subash)
#### Post date: [September 24, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864/1 "2020-09-24T18:03:17Z")
I am receiving logs every 5 minutes from many devices.
In the log, there is field called **crc\_error** which holds numeric value
For a particular Device, if the value of the **crc\_error** field increases consecutively for 3 logs (lets say at 12:00, 12:05 and 12:10) then a field with a warning message should be added to the log received at 12:10.
I want to compare the value of the field **crc\_error** with the value of **crc\_error** of the previous log. If the previous value is smaller than the current value then I want to compare the previous value with its previous value.
Please help me to achieve this using logstash.
Thanks.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 24, 2020, 6:17pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864/2 "2020-09-24T18:17:40Z")
I would do that in a ruby filter. Use a pair of hashes, with the device id as the key, to store the previous two values. Do the comparisons, use event.set to add field to the event if needed, then shift the last but one value to the last but two hash and overwrite the last but one value with the current value.
I would recommend that you run with pipeline.workers to 1 so that the same thread processes all of the events.
logstash may not preserve event order, but if they are 5 minutes apart I do not think you will have issues with that.
---
### Author:  [@subash](https://discuss.elastic.co/u/subash)
#### Post date: [September 25, 2020, 2:47pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864/3 "2020-09-25T14:47:03Z")
Hi@Badger,
Thanks you for the reply.
I am thinking of using ElasticSearch filter plugin in logstash to fetch the previous 2 events from the index.
Will I be able to pass the fields (DeviceName and crc\_error) dynamically in the elasticsearch query to fetch the previous events?
Can I use the query, which I built using kibana dev tools, in elasticsearch filter? Or there will be a change in format?
Is it possible? Please suggest
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 25, 2020, 2:53pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864/4 "2020-09-25T14:53:22Z")
> [@subash](#):
>
> I am thinking of using Elasticsearch filter plugin in logstash to fetch the previous 2 events from the index.
That is another possibility.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2020, 2:53pm UTC](https://discuss.elastic.co/t/how-to-compare-the-current-event-with-the-previous-2-events-in-logstash/249864/5 "2020-10-23T14:53:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.