# How to filter results based upon values using logstash ruby

**URL:** https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913
**Category:** Logstash
**Created:** [June 19, 2017, 10:17am UTC](https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913 "2017-06-19T10:17:19Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sachintanpure85](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sachintanpure85](https://discuss.elastic.co/u/sachintanpure85)
#### Post date: [June 19, 2017, 10:17am UTC](https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913/1 "2017-06-19T10:17:19Z")

</div>

I want filter the results based upon some column values of the index and perform math operation.  
'tier0\_cnt','tier1\_cnt','tier2\_cnt','tier0\_amt','tier1\_amt','tier2\_amt' are the columns of my index.  
I am using below logstash filter for that .

filter {  
ruby {  
code =\> "if [event.get('tier0\_amt').to\_i] \> '9999'  
event.set('tier1\_cnt',event.get('tier1\_cnt').to\_i+event.get('tier0\_cnt').to\_i);  
event.set('tier1\_amt',event.get('tier0\_amt').to\_i+10000);  
else  
event.set('tier2\_amt',event.get('tier0\_amt').to\_i+10000);  
event.set('tier2\_cnt',event.get('tier0\_cnt').to\_i\*5;  
end"  
}  
}

but while executing the logstash script ,I am getting errors:  
04:57:23.184 [[main]\>worker1] ERROR logstash.filters.ruby - Ruby exception occurred: undefined method `\>' for [10000]:Array

how can we apply multiple filters in ruby like if else?

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [June 20, 2017, 11:14am UTC](https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913/2 "2017-06-20T11:14:12Z")

</div>

> [@sachintanpure85](#):
>
> code =\> "if [event.get('tier0\_amt').to\_i] \> '9999'

should be;

```auto
code => "if event.get('tier0_amt').to_i > 9999

```

---

<div class="post-metadata">

### Author: ![sachintanpure85](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sachintanpure85](https://discuss.elastic.co/u/sachintanpure85)
#### Post date: [June 20, 2017, 11:24am UTC](https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913/3 "2017-06-20T11:24:15Z")

</div>

Thanks it , worked 🙂

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [June 20, 2017, 12:02pm UTC](https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913/4 "2017-06-20T12:02:01Z")

</div>

Great. By way of explanation for future readers:

In the line `[event.get('tier0_amt').to_i] > '9999'` the LHS is a single element **array** containing the value from the `'tier0_amt'` field, the RHS is a **string** constant. The operator `>` (greater\_than) is applied as a method to the array with the string constant as the method parameter. The Ruby Array class does not have a `>` method. Hence the `undefined method '>' for [10000]:Array` error. So `[10000].>('9999')` gives the error but `10000.>('9999')` returns `true`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2017, 12:02pm UTC](https://discuss.elastic.co/t/how-to-filter-results-based-upon-values-using-logstash-ruby/89913/5 "2017-07-18T12:02:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
