# HowTo: Integer comparison in logstash filter
**URL:** https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675
**Category:** Logstash
**Created:** [April 6, 2019, 1:42pm UTC](https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675 "2019-04-06T13:42:26Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@arberg](https://discuss.elastic.co/u/arberg)
#### Post date: [April 6, 2019, 1:42pm UTC](https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675/1 "2019-04-06T13:42:27Z")
I cannot get integer comparisons to work in logstash filter, using logstash 6.4.2.
```
input {
beats {
port => 5044
}
}
filter {
mutate {
add_field => { "[@metadata][myLogLevel]" => 1 }
add_field => { "[@metadata][day]" => "%{+dd}"}
convert => { "[@metadata][day]" => "integer" }
add_field => { "testDay" => "%{[@metadata][day]}" } # Copy to non-metadata field I can see in logs in kibana
add_field => { "testDayFloat" => "%{[@metadata][day]}" }
convert => { "testDay" => "integer" }
convert => { "testDayFloat" => "float" }
}
if [@metadata][myLogLevel] < 10 { # this line fails with runtime error 'comparison of String with 10 failed'
mutate {
add_field => { "[@metadata][dayDiv10]" => "whatever" }
}
}
if [@metadata][day] < 10 { # this line fails with runtime error 'comparison of String with 10 failed'
mutate {
add_field => { "[@metadata][dayDiv10]" => "0" }
}
}
if [testDay] < 10 { # this line fails with runtime error 'comparison of String with 10 failed'
mutate {
add_field => { "[@metadata][dayDiv10]" => "0" }
}
}
if [testDayFloat] < 10 { # this line fails with runtime error 'comparison of String with 10 failed'
mutate {
add_field => { "[@metadata][dayDiv10]" => "0" }
}
}
}
output {
elasticsearch {
...
}
}
```
I've tried the above, with each of the four failing lines included one at a time. As for as I understand from examples, questions and docs this should work, though I'm not sure about setting the metadata directly to an integer, the [@metadata][myLogLevel] line. But I've seen lots of examples doing the integer convert.
I get a runtime error when logstash reads a message, saying 'comparison of String with 10 failed'.
Any clue what I'm doing wrong?
It works for me when I do if-statement processing with ==, and =!, but not with \>, presumably because both sides get converted to strings.
note the day is '06', not '6', I don't know if that gets converted to integer. After conversion to integer, kibana still shows a field containing '06'.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 6, 2019, 2:27pm UTC](https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675/2 "2019-04-06T14:27:49Z")
> [@arberg](#):
>
> note the day is '06', not '6', I don't know if that gets converted to integer. After conversion to integer, kibana still shows a field containing '06'.
This is your issue. None of the converts are happening. A mutate filter does things in a [fixed order](https://github.com/logstash-plugins/logstash-filter-mutate/blob/091207d5184af1f38626c9e24cce070674a410f5/lib/logstash/filters/mutate.rb#L247), and once it has done all of that it decorates the event (that's the call to filter\_matched()), which implements common options like add\_field. That means the the convert executes before the add\_field, so none of the fields exist when you try to convert them. Split your mutate into two
```
mutate {
add_field => { "[@metadata][myLogLevel]" => 1 }
add_field => { "[@metadata][day]" => "%{+dd}"}
add_field => { "testDay" => "%{[@metadata][day]}" } # Copy to non-metadata field I can see in logs in kibana
add_field => { "testDayFloat" => "%{[@metadata][day]}" }
}
mutate {
convert => { "[@metadata][day]" => "integer" }
convert => { "testDay" => "integer" }
convert => { "testDayFloat" => "float" }
}
```
---
### Author:  [@arberg](https://discuss.elastic.co/u/arberg)
#### Post date: [April 10, 2019, 10:51am UTC](https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675/3 "2019-04-10T10:51:14Z")
Awesome, thank you for the quick response and accurate solution. It works! Ahh so nice 🙂
I have posted the question and answer here for better future reference for others (I kind of regret not posting it there in the first place):
>
If you wish you are welcome to answer it there with your profile, and I'll accept that, if you care about the public credits.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 8, 2019, 10:51am UTC](https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675/4 "2019-05-08T10:51:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.