# 'less/greater than or equal to' forgotten?

**URL:** https://discuss.elastic.co/t/less-greater-than-or-equal-to-forgotten/74298
**Category:** Logstash
**Created:** [February 7, 2017, 10:59pm UTC](https://discuss.elastic.co/t/less-greater-than-or-equal-to-forgotten/74298 "2017-02-07T22:59:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![wols](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wols/32/15322_2.png) [@wols](https://discuss.elastic.co/u/wols)
#### Post date: [February 7, 2017, 10:59pm UTC](https://discuss.elastic.co/t/less-greater-than-or-equal-to-forgotten/74298/1 "2017-02-07T22:59:25Z")

</div>

A first issue here: [https://github.com/elastic/logstash/issues/6652](https://github.com/elastic/logstash/issues/6652)  
After update to logstash-5.1.2 now the question here.

Config File:

```
filter {
    if [score] >= 10 { mutate { ... } }
}

```

Sample Data:

```
{"@timestamp":"2017-02-07T16:38:21.767Z","score":20.0}

```

logstash-plain.log

```
Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<NoMethodError: undefined method `>=' for nil:NilClass>, ...

```

The log shows `undefined method '>='` but I see 'equality' in documentation here  
[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals)  
and a example here

> <https://stackoverflow.com/questions/35489901/logstash-compare-a-field-to-a-number>

---

<div class="post-metadata">

### Author: ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)
#### Post date: [February 8, 2017, 12:51am UTC](https://discuss.elastic.co/t/less-greater-than-or-equal-to-forgotten/74298/2 "2017-02-08T00:51:44Z")

</div>

I ran a simple test to see if I could replicate what you're seeing:

```auto
input { stdin { } }

filter {
  mutate { add_field => { "score" => "20.0" } }
  mutate { convert => { "score" => "float" } }
  if [score] >= 10 { 
    mutate { add_field => { "greater" => "yes" } } 
  }
  else { 
    mutate { add_field => { "greater" => "no" } } 
  }
}

output { stdout { codec => rubydebug } }

```

This simply adds a field called `score` and sets it to `"20.0"` (a string). It then mutates it into a `float` value.

It does a comparison to see if `[score] >= 10`, and adds the field greater with the value of "yes" if it is (and 20 is definitely greater than 10), and "no" if it isn't. This is the output I got:

```auto
17:45:58.595 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9602}
asdf
{
         "score" => 20.0,
    "@timestamp" => 2017-02-08T00:46:02.189Z,
      "@version" => "1",
          "host" => "logstash",
       "message" => "asdf",
       "greater" => "yes"
}

```

As you can see, the `asdf` I typed is `message`, and the other fields were added and the `>=` test worked as expected.

The question is why you're seeing something different. It's hard to guess, since the error posted to the issue is truncated. It will give that error if you try to compare a string to an integer (and it will say so in the full error).

I know in your JSON there that score is a numeric value, but does Logstash see it as such?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 8, 2017, 6:48am UTC](https://discuss.elastic.co/t/less-greater-than-or-equal-to-forgotten/74298/3 "2017-02-08T06:48:32Z")

</div>

Here's the important part of the error message:

> NoMethodError: undefined method `\>=' for nil:NilClass

This indicates that the event didn't have a `score` field.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2017, 6:48am UTC](https://discuss.elastic.co/t/less-greater-than-or-equal-to-forgotten/74298/4 "2017-03-08T06:48:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.