# IF less than value is not working **URL:** \ **Category:** Logstash\ **Created:** [October 4, 2019, 7:37pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381 "2019-10-04T19:37:51Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)\ **Post date:** [October 4, 2019, 7:37pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/1 "2019-10-04T19:37:51Z")
Hello, I am trying to check if the YEAR value is less than 100 other the value in YEAR is for example 2012 otherwise it'll be 12 or so on for different year. However, it is throwing an error. I can't seem to compare and it can't seem to recognize the less than value. > if [YEAR] \< 100 { > mutate { > update =\> {"YEAR" =\> "20%{YEAR}"} > } > } Side note: this if is found within the filter value and the field YEAR was created from a different field M YEARS using the grok option which looks as follows > grok { > match =\> {"M YEARS" =\> "%{NUMBER:YEAR}"} > } ---
**Author:** ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)\ **Post date:** [October 4, 2019, 7:40pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/2 "2019-10-04T19:40:58Z")
This was included in the error > An unexpected error occurred! {:error=\>#\, :backtrace=\> ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 4, 2019, 8:09pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/3 "2019-10-04T20:09:22Z")
> [@edster](#): > > match =\> {"M YEARS" =\> "%{NUMBER:YEAR}"} You cannot compare whether a string is less than a number. Does ``` match => {"M YEARS" => "%{NUMBER:YEAR:int}"} ``` help? ---
**Author:** ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)\ **Post date:** [October 4, 2019, 8:15pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/4 "2019-10-04T20:15:35Z")
Above the if statement I added > mutate { > convert =\> {"YEAR" =\> "integer"} > } sorry I forgot to mention before ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 4, 2019, 8:30pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/5 "2019-10-04T20:30:03Z")
OK, in that case the field [YEAR] does not exist. ---
**Author:** ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)\ **Post date:** [October 6, 2019, 4:48pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/6 "2019-10-06T16:48:25Z")
SO it doesn't get created? or at what point would I be able to use the if statement. However, how could it not exist if right above the if I did the convert and it found it there. If I don't add the if statement the update works on field so I don't understand why it can't find it when using the if statement. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 6, 2019, 5:47pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/7 "2019-10-06T17:47:55Z")
Each plugin within the filter is executed in the order it appears. If the grok comes before the mutate I would expect the field to exist. To get around the error you should test whether it exists before testing its value. ``` if [YEAR] and [YEAR] < 100 { ``` ---
**Author:** ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)\ **Post date:** [October 7, 2019, 1:52pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/8 "2019-10-07T13:52:10Z")
Pretty strange, but I added this if statement rather than the previous one and it seems to have given the wanted/expected result, however, it throws this error which looks like it might be a field type that it's getting an error over. > [WARN] [[main]\>worker7] elasticsearch - Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>"380512", :\_index=\>"addedyear\_index", :\_type=\>"doc", :routing=\>nil}, #LogStash::Event:0x4b6ec64e], :response=\>{"index"=\>{"\_index"=\>"addedyear\_index", "\_type"=\>"doc", "\_id"=\>"380512", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"mapper [YEAR] of different type, current\_type [text], merged\_type [long]"}}}} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2019, 1:52pm UTC](https://discuss.elastic.co/t/if-less-than-value-is-not-working/202381/9 "2019-11-04T13:52:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.