# Logstash Comparing Field Values Using an If Statement not working

**URL:** <https://discuss.elastic.co/t/logstash-comparing-field-values-using-an-if-statement-not-working/251452>\
**Category:** Logstash\
**Created:** [October 8, 2020, 1:38pm UTC](https://discuss.elastic.co/t/logstash-comparing-field-values-using-an-if-statement-not-working/251452 "2020-10-08T13:38:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bardie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bardie/32/36173_2.png) [@bardie](https://discuss.elastic.co/u/bardie)\
**Post date:** [October 8, 2020, 1:38pm UTC](https://discuss.elastic.co/t/logstash-comparing-field-values-using-an-if-statement-not-working/251452/1 "2020-10-08T13:38:13Z")

</div>

Hi,

I am trying to compare two fields using the following method but it is not working. I have used it before using an older version of logstash and it worked but it is not working on logstash 7.9.2.

Logstash cannot be able to compare values in two different fields:

**Example:**  
_old\_user = john_  
_new\_user = john_

Will result in the creation of the field\_change field even though the fields have the same value.

Below is the code:

```auto
    if [old_USER] != "%{new_USER}" {
          mutate {
              add_field => { "field_change" => "user" }
         }
    }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 8, 2020, 3:16pm UTC](https://discuss.elastic.co/t/logstash-comparing-field-values-using-an-if-statement-not-working/251452/2 "2020-10-08T15:16:26Z")

</div>

> [@bardie](#):
>
> `if [old_USER] != "%{new_USER}" {`

Why not use

```
if [old_USER] != [new_USER] {

```

---

<div class="post-metadata">

**Author:** ![bardie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bardie/32/36173_2.png) [@bardie](https://discuss.elastic.co/u/bardie)\
**Post date:** [October 9, 2020, 6:12am UTC](https://discuss.elastic.co/t/logstash-comparing-field-values-using-an-if-statement-not-working/251452/3 "2020-10-09T06:12:48Z")

</div>

This worked. Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2020, 6:12am UTC](https://discuss.elastic.co/t/logstash-comparing-field-values-using-an-if-statement-not-working/251452/4 "2020-11-06T06:12:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.