# Logstash creates switch case using ruby code
**URL:** https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581
**Category:** Logstash
**Created:** [August 2, 2019, 3:30pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581 "2019-08-02T15:30:43Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)
#### Post date: [August 2, 2019, 3:30pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/1 "2019-08-02T15:30:43Z")
Hi all,
Trying to do something like a switch case as below :
`if value < 1 then field = 'low' else if value >= 1 && < 20 then field = 'medium' else if value >= 20 && < 50 then field = 'high' else field = 'veryHigh'`
but with the ruby code plugin
So far what I got :
`event.set('field', (event.get('value').nil?) ? nil : (event.get('value') < 1000000) ? 'Low' : (event.get('value') >= 1000000 && event.get('value') < 20000000) ? 'Medium' : (event.get('value') >= 20000000 && event.get('value') < 50000000) ? 'High' : 'VeryHigh')`
but my output contains `"tags":["_rubyexception"]}`
Thanks
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [August 2, 2019, 3:56pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/2 "2019-08-02T15:56:26Z")
I didn't try it, but I guess there would have to be some more brackets around each step of the way so solve this with a long long long one-liner, but reading that hurts anyway. Would it be horrible to use the long version?
```
if event.get('value').nil? then
event.set('field', nil)
elsif event.get('value') < 1000000 then
event.set('field', 'Low')
elsif … etc etc etc …
…
end
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 2, 2019, 4:09pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/3 "2019-08-02T16:09:36Z")
That ruby works just fine, although I would agree with Jenni that it is ugly and it would be better to do it with and if-else if-else if.
What does the rest of the ruby filter look like and what error message does it log?
You will get "comparison of String with 1000000 failed" if value is a type of String.
---
### Author:  [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)
#### Post date: [August 5, 2019, 1:52pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/4 "2019-08-05T13:52:37Z")
Hi @Jenni and @Badger and thanks for answering
The other part of my ruby code should be alright. I've been using it perfectly so far without errors.
I'll try your version, I agree with you
Let me few minutes to try it out
Thanks
---
### Author:  [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)
#### Post date: [August 5, 2019, 2:48pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/5 "2019-08-05T14:48:55Z")
Still got the same ...
```
input {
generator {
lines => ["test,value,tset","aaaaa,1,aaaaa","bbb,,bbb","ccc,1000050,ccc","ddd,20000050,ddd","eee,50009000,eee"]
count => 3
type => "test"
}
}
filter {
if [type] == "test" {
csv {
skip_header => "true"
separator => ","
columns => ["test", "value", "tset"]
}
ruby { code => "
if event.get('value').nil? then
event.set('field', nil)
elsif event.get('value') < 1000000 then
event.set('field', 'Low')
elsif event.get('value') >= 1000000 && event.get('value') < 20000000 then
event.set('field', 'Medium')
elsif event.get('value') >= 20000000 && event.get('value') < 50000000 then
event.set('field', 'High')
else event.set('field', 'VeryHigh')
end
" }
}
}
output { if [type] == "test" { stdout { codec => json_lines } } }
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 5, 2019, 2:59pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/6 "2019-08-05T14:59:11Z")
```
[ERROR][logstash.filters.ruby] Ruby exception occurred: comparison of String with 1000000 failed
```
Are you reading the error message? Add this to your csv filter
```
convert => { "value" => integer }
```
---
### Author:  [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)
#### Post date: [August 5, 2019, 3:03pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/7 "2019-08-05T15:03:49Z")
Can't believe I didn't see this error before ...
Working as expected now
Many thanks to both !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 2, 2019, 3:03pm UTC](https://discuss.elastic.co/t/logstash-creates-switch-case-using-ruby-code/193581/8 "2019-09-02T15:03:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.