IF less than value is not working

[edster (Edgar Lucero)]

Hello, I am trying to check if the YEAR value is less than 100 other the value in YEAR is for example 2012 otherwise it'll be 12 or so on for different year. However, it is throwing an error. I can't seem to compare and it can't seem to recognize the less than value.

if [YEAR] < 100 {
mutate {
update => {"YEAR" => "20%{YEAR}"}
}
}

Side note: this if is found within the filter value and the field YEAR was created from a different field M YEARS using the grok option which looks as follows

grok {
match => {"M YEARS" => "%{NUMBER:YEAR}"}
}

[edster (Edgar Lucero)]

This was included in the error

An unexpected error occurred! {:error=>#<NoMethodError: undefined method `<' for nil:NilClass>, :backtrace=>

[Badger]

@edster

match => {"M YEARS" => "%{NUMBER:YEAR}"}

You cannot compare whether a string is less than a number. Does

match => {"M YEARS" => "%{NUMBER:YEAR:int}"}

help?

[edster (Edgar Lucero)]

Above the if statement I added

mutate {
convert => {"YEAR" => "integer"}
}

sorry I forgot to mention before

[Badger]

OK, in that case the field [YEAR] does not exist.

[edster (Edgar Lucero)]

SO it doesn't get created? or at what point would I be able to use the if statement. However, how could it not exist if right above the if I did the convert and it found it there. If I don't add the if statement the update works on field so I don't understand why it can't find it when using the if statement.

[Badger]

Each plugin within the filter is executed in the order it appears. If the grok comes before the mutate I would expect the field to exist. To get around the error you should test whether it exists before testing its value.

if [YEAR] and [YEAR] < 100 {

[edster (Edgar Lucero)]

Pretty strange, but I added this if statement rather than the previous one and it seems to have given the wanted/expected result, however, it throws this error which looks like it might be a field type that it's getting an error over.

[WARN ] [[main]>worker7] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"380512", :_index=>"addedyear_index", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x4b6ec64e], :response=>{"index"=>{"_index"=>"addedyear_index", "_type"=>"doc", "_id"=>"380512", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [YEAR] of different type, current_type [text], merged_type [long]"}}}}