# Kibana canvas "compare" function (expression language)

**URL:** <https://discuss.elastic.co/t/kibana-canvas-compare-function-expression-language/294484>\
**Category:** Kibana\
**Tags:** canvas\
**Created:** [January 15, 2022, 3:38pm UTC](https://discuss.elastic.co/t/kibana-canvas-compare-function-expression-language/294484 "2022-01-15T15:38:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [January 15, 2022, 3:38pm UTC](https://discuss.elastic.co/t/kibana-canvas-compare-function-expression-language/294484/1 "2022-01-15T15:38:24Z")

</div>

Hi Guys,  
So I am trying to use the "compare" expression to change field values.  
The problem I am currently facing is that only the first case value works, all the others goes to "other" (default).  
In this example, only the first "User name does not exist" works.  
Is this a bug?

```auto
| mapColumn winlog.event_data.SubStatus 
  fn={getCell winlog.event_data.SubStatus | switch {case if={compare eq to="0xc0000064"} then="User name does not exist"} {case if={compare eq to="0xc000006a"} then="User name is correct but the password is wrong"} {case if={compare eq to="0xc0000234"} then="User" "is" "currently" "locked" "out"} {case if={compare eq to="0xc0000072"} then="Account" "is" "currently" "disabled"} {case if={compare eq to="0xc000006F"} then="User" "tried" "to" "logon" "outside" "his" "time" "restrictions"} {case if={compare eq to="0xc0000070"} then="Workstation restriction, or Authentication Policy Silo violation (look for event ID 4820 on domain controller"} {case if={compare eq to="0xc0000193"} then="Account expiration"} {case if={compare eq to="0xc0000071"} then="Expired password"} {case if={compare eq to="0xc0000133"} then="Clocks between DC and other computer too far out of sync"} {case if={compare eq to="0xc0000224"} then="User is required to change password at next logon"} {case if={compare eq to="0xc0000225"} then="Evidently a bug in Windows and not a risk"} {case if={compare eq to="0xc000015b"} then="The user has not been granted the requested logon type (aka logon right) at this machine"} default="other"}

```

---

<div class="post-metadata">

**Author:** ![rusty\_cole](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rusty\_cole](https://discuss.elastic.co/u/rusty_cole)\
**Post date:** [January 16, 2022, 7:08am UTC](https://discuss.elastic.co/t/kibana-canvas-compare-function-expression-language/294484/2 "2022-01-16T07:08:10Z")

</div>

Found the following post confirming its a bug.

> [@Canvas switch case not working after first case](https://discuss.elastic.co/t/canvas-switch-case-not-working-after-first-case/288627):
>
> Hi, I am trying to use switch cases in canvas kibana (7.14) but it's not working. I tried to use the demo data with the following code: demodata | mapColumn "project\_map" fn=${getCell "project" | switch {case if={compare eq to="kibana"} then="kibana"} {case if={compare eq to="elasticsearch"} then="elasticsearch"} {case if={compare eq to="beats"} then="beats"} default="other" } | table | render and ended up with this result: [image] It appears that after the …

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2022, 7:08am UTC](https://discuss.elastic.co/t/kibana-canvas-compare-function-expression-language/294484/3 "2022-02-13T07:08:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.