# If statement ruby filter
**URL:** https://discuss.elastic.co/t/if-statement-ruby-filter/305093
**Category:** Logstash
**Created:** [May 18, 2022, 4:05pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093 "2022-05-18T16:05:44Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [May 18, 2022, 4:05pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/1 "2022-05-18T16:05:44Z")
Hi,
I have a small problem in if statement under ruby
here my code:
```auto
filter {
grok { match => { "message" => "%{GREEDYDATA:log_message}" }}
mutate { split => {"message" => "|"} }
ruby {
code => "event.set('number_of_elements', event.get('message').length)
event.set('x', 0)
if 'EXCEPTION' in [log_message]
event.set('DETAIL EXCEPTION', event.get('message')[event.get('x')])
end
"
}
}
```
Maybe syntax or something else ...?
Any help would be sincerely appreciate!
Thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 18, 2022, 5:10pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/2 "2022-05-18T17:10:28Z")
> [@alex\_vermex](#):
>
> Maybe syntax or something else ...?
Indeed. Try
```
ruby {
code => '
event.set("number_of_elements", event.get("message").length)
event.set("x", 0)
if event.get("log_message").include?("EXCEPTION")
event.set("DETAIL EXCEPTION", event.get("message")[event.get("x")])
end
'
}
```
But why bother setting the field x, why not use `event.get("message")[0]`?
---
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [May 18, 2022, 8:27pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/3 "2022-05-18T20:27:35Z")
Thanks for the reply
indeed, my goal is that when I add a field, I want it to take the value of `message[0] message[1]message[2]....`
```auto
ruby {
code => "event.set('DateTime', event.get('message')[event.get('x')])
event.set('x', (event.get('x')) + 1)
event.set('version', event.get('message')[event.get('x')])
event.set('x', (event.get('x')) + 1)
event.set('GateWay Operation', event.get('message')[event.get('x')])
event.set('x', (event.get('x')) + 1)
if event.get('GateWay Operation') == 'PAIEMENT '
event.set('Id', event.get('message')[event.get('x')])
event.set('x', (event.get('x')) + 1)
end
if event.get('log_message').include?('EXCEPTION')
event.set('DETAIL EXCEPTION', event.get('message')[event.get('x')])
end
"
}
```
so in this case if `('GateWay Operation') == 'PAYMENT '` **"Id"** it will be `message[3]` ok then if `EXCEPTION in log_message` **"DETAIL EXCEPTION"** this will be `message[4]`, right?
Ok now imagine `('GateWay Operation') != 'PAYMENT' and EXCEPTION in log_message` so in this case **"DETAIL EXCEPTION"** will be in `message[3]` not 4. so imagine I have so a lot if condition like this that's why i am using this but i don't know if i can optimize my code.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 18, 2022, 9:29pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/4 "2022-05-18T21:29:04Z")
I understand now why you cannot use a csv filter, but I would do it all in one ruby filter.
```
ruby {
code => '
m = event.get("message").split("|")
# .shift removes the first value in an array and returns it
event.set("DateTime", m.shift)
event.set("version", m.shift)
event.set("GateWay Operation", m.shift)
if event.get("GateWay Operation") == 'PAIEMENT '
event.set("Id", m.shift)
end
if event.get("log_message").include?("EXCEPTION")
event.set("DETAIL EXCEPTION", m.shift)
end
'
}
```
---
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [May 19, 2022, 9:33am UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/5 "2022-05-19T09:33:27Z")
Wow i liked this one thank you very much @Badger last thing please about the if statement too
```auto
ruby {
code => "if #the rest of the pipe is == 5 blocks
event.set('Status', m.shift)
event.set('Code', m.shift)
end"
}
```
`if the rest of the pipeline = 5` I'm new to ruby filter so I'm not good at ruby filter syntax sorry about that. and I don't know if it's possible to verify the rest of the pipeline.
Once again thank you @Badger
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 19, 2022, 3:08pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/6 "2022-05-19T15:08:55Z")
Not sure what you mean but maybe `if m.length == 5`?
---
### Author:  [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)
#### Post date: [May 19, 2022, 3:42pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/7 "2022-05-19T15:42:50Z")
Exactly thank you!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2022, 3:43pm UTC](https://discuss.elastic.co/t/if-statement-ruby-filter/305093/8 "2022-06-16T15:43:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.