IF less than value is not working

Elastic Stack Logstash
1

Hello, I am trying to check if the YEAR value is less than 100 other the value in YEAR is for example 2012 otherwise it'll be 12 or so on for different year. However, it is throwing an error. I can't seem to compare and it can't seem to recognize the less than value.

if [YEAR] < 100 {
mutate {
update => {"YEAR" => "20%{YEAR}"}
}
}

Side note: this if is found within the filter value and the field YEAR was created from a different field M YEARS using the grok option which looks as follows

grok {
match => {"M YEARS" => "%{NUMBER:YEAR}"}
}

2

This was included in the error

An unexpected error occurred! {:error=>#<NoMethodError: undefined method `<' for nil:NilClass>, :backtrace=>

3

You cannot compare whether a string is less than a number. Does

match => {"M YEARS" => "%{NUMBER:YEAR:int}"}

help?

4

Above the if statement I added

mutate {
convert => {"YEAR" => "integer"}
}

sorry I forgot to mention before

5

OK, in that case the field [YEAR] does not exist.

6

SO it doesn't get created? or at what point would I be able to use the if statement. However, how could it not exist if right above the if I did the convert and it found it there. If I don't add the if statement the update works on field so I don't understand why it can't find it when using the if statement.

7

Each plugin within the filter is executed in the order it appears. If the grok comes before the mutate I would expect the field to exist. To get around the error you should test whether it exists before testing its value.

if [YEAR] and [YEAR] < 100 {
8

Pretty strange, but I added this if statement rather than the previous one and it seems to have given the wanted/expected result, however, it throws this error which looks like it might be a field type that it's getting an error over.

[WARN ] [[main]>worker7] elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>"380512", :_index=>"addedyear_index", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x4b6ec64e], :response=>{"index"=>{"_index"=>"addedyear_index", "_type"=>"doc", "_id"=>"380512", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [YEAR] of different type, current_type [text], merged_type [long]"}}}}

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.