# How to create a filed based on a condition

**URL:** <https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129>\
**Category:** Logstash\
**Created:** [October 28, 2015, 7:47am UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129 "2015-10-28T07:47:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Post date:** [October 28, 2015, 7:47am UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/1 "2015-10-28T07:47:47Z")

</div>

Hi Experts,

I want to create a filed (pri\_caption) in logstash based on a condition i.e  
addfield pri\_caption {  
if **priority** between 1 to 3 then "low"  
else if **priority** between 4 to 7 then "medium"  
elase High  
}

Please suggest how I can achieve this ?

Thanks  
VG

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 28, 2015, 7:57am UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/2 "2015-10-28T07:57:50Z")

</div>

Example:

```
filter {
  if [priority] >= 1 and [priority] <= 3 {
    mutate {
      add_field => ["pri_caption", "low"]
    }
  }
}

```

If there's an enumerable number of priorities you could also use the translate filter.

---

<div class="post-metadata">

**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Post date:** [October 28, 2015, 8:01am UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/3 "2015-10-28T08:01:54Z")

</div>

Thanks Magnus,

May I achieve the same with scripted filed as well, I mean what if I do not want to do this in LS . What if I want to achieve this at the time of search in kibana ?

Thanks  
VG

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 28, 2015, 11:33am UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/4 "2015-10-28T11:33:54Z")

</div>

You should be able to set up a scripted field for this. Lucene expressions support the ternary operator so if you just want "low", "medium", or "high" depending on the value of a numerical field it should be trivial.

---

<div class="post-metadata">

**Author:** ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Post date:** [October 28, 2015, 2:20pm UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/5 "2015-10-28T14:20:54Z")

</div>

> [@magnusbaeck](#):
>
> so if you just want "low", "medium", or "high" depending on the value of a numerical field it should be trivial

so I tried this but it does not work  
doc['priority'].value == 9 ? high : low

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 28, 2015, 2:49pm UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/6 "2015-10-28T14:49:36Z")

</div>

You'll have to double-quote the strings, but glancing at the docs I'm not sure strings are supported in Lucene expressions. You may have to enable Groovy scripts, but I'm out of my depth here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/how-to-create-a-filed-based-on-a-condition/33129/7 "2017-07-06T05:25:03Z")

</div>