### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 8, 2020, 2:18pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/7 "2020-08-08T14:18:28Z")
> [@masech](#):
>
> ```auto
> if ((event.getField('[octet_1]')==0)||
> ((event.getField('[octet_1]')==10)||
> ((event.getField('[octet_1]')==127)||
> (((event.getField('[octet_1]')==100)&&((event.getField('[octet_2]')>=64)&&(event.getField('[octet_2]')<=127)))||
> (((event.getField('[octet_1]')==172)&&((event.getField('[octet_2]')>=16)&&(event.getField('[octet_2]')<=31)))||
> (((event.getField('[octet_1]')==192)&&(event.getField('[octet_2]')==168))||
> ((event.getField('[octet_1]')==169)&&(event.getField('[octet_2]')==254))))))))]
>
> ```
The compiled version of the conditional looks wrong to me!
---
### Author:  [@masech](https://discuss.elastic.co/u/masech)
#### Post date: [August 8, 2020, 7:48pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/8 "2020-08-08T19:48:39Z")
Yes, it looks like it is. But I ran the `convert` option of Mutate filter in debug mode and the compiled version of the conditional looks the same:
````auto
[DEBUG] 2020-08-08 22:30:10.161 [Converge PipelineAction::Create] JavaBasePipelineExt - Compiled pipeline code for pipeline main : **GRAPH**
Vertices: 7 Edges: 7
----------------------P[input-stdin{}|[str]pipeline:2:5:```
stdin { }
```] -> __QUEUE__
__QUEUE__ -> P[filter-dissect{"mapping"=>{"message"=>"%{octet_1}.%{octet_2}.%{octet_3}.%{octet_4}"}}|[str]pipeline:8:5:```
dissect {
mapping => {
"message" => "%{octet_1}.%{octet_2}.%{octet_3}.%{octet_4}"
}
}
```]
P[filter-dissect{"mapping"=>{"message"=>"%{octet_1}.%{octet_2}.%{octet_3}.%{octet_4}"}}|[str]pipeline:8:5:```
dissect {
mapping => {
"message" => "%{octet_1}.%{octet_2}.%{octet_3}.%{octet_4}"
}
}
```] -> P[filter-mutate{"convert"=>{"octet_1"=>"integer", "octet_2"=>"integer", "octet_3"=>"integer", "octet_4"=>"integer"}}|[str]pipeline:14:5:```
mutate {
convert => {
"octet_1" => "integer"
"octet_2" => "integer"
"octet_3" => "integer"
"octet_4" => "integer"
}
}
```]
P[filter-mutate{"convert"=>{"octet_1"=>"integer", "octet_2"=>"integer", "octet_3"=>"integer", "octet_4"=>"integer"}}|[str]pipeline:14:5:```
mutate {
convert => {
"octet_1" => "integer"
"octet_2" => "integer"
"octet_3" => "integer"
"octet_4" => "integer"
}
}
```] -> [if ((event.getField('[octet_1]')==0)||((event.getField('[octet_1]')==10)||((event.getField('[octet_1]')==127)||(((event.getField('[octet_1]')==100)&&((event.getField('[octet_2]')>=64)&&(event.getField('[octet_2]')<=127)))||(((event.getField('[octet_1]')==172)&&((event.getField('[octet_2]')>=16)&&(event.getField('[octet_2]')<=31)))||(((event.getField('[octet_1]')==192)&&(event.getField('[octet_2]')==168))||((event.getField('[octet_1]')==169)&&(event.getField('[octet_2]')==254))))))))]
[if ((event.getField('[octet_1]')==0)||((event.getField('[octet_1]')==10)||((event.getField('[octet_1]')==127)||(((event.getField('[octet_1]')==100)&&((event.getField('[octet_2]')>=64)&&(event.getField('[octet_2]')<=127)))||(((event.getField('[octet_1]')==172)&&((event.getField('[octet_2]')>=16)&&(event.getField('[octet_2]')<=31)))||(((event.getField('[octet_1]')==192)&&(event.getField('[octet_2]')==168))||((event.getField('[octet_1]')==169)&&(event.getField('[octet_2]')==254))))))))] -|true|-> P[filter-drop{}|[str]pipeline:34:9:```
drop { }
```]
[if ((event.getField('[octet_1]')==0)||((event.getField('[octet_1]')==10)||((event.getField('[octet_1]')==127)||(((event.getField('[octet_1]')==100)&&((event.getField('[octet_2]')>=64)&&(event.getField('[octet_2]')<=127)))||(((event.getField('[octet_1]')==172)&&((event.getField('[octet_2]')>=16)&&(event.getField('[octet_2]')<=31)))||(((event.getField('[octet_1]')==192)&&(event.getField('[octet_2]')==168))||((event.getField('[octet_1]')==169)&&(event.getField('[octet_2]')==254))))))))] -|false|-> P[output-stdout{"codec"=>"rubydebug"}|[str]pipeline:40:5:```
stdout { codec => rubydebug }
```]
P[filter-drop{}|[str]pipeline:34:9:```
drop { }
```] -> P[output-stdout{"codec"=>"rubydebug"}|[str]pipeline:40:5:```
stdout { codec => rubydebug }
```]
**GRAPH**
````
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 8, 2020, 8:34pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/9 "2020-08-08T20:34:27Z")
Having been through it, the reason it looks wrong is that it is explicitly including the implied short circuits used when evaluating conditionals.
The conditional
```
a or b or c or d
```
Requires one of the four to be true. If the first is true the system will not bother evaluating the rest. So you can represent that as
a or (b or (c or d))
which means it tests a and if that is true it does not bother evaluating the RHS '(b or (c or d))'. The more if statements you have the greater the number of close parentheses at the end.
Looking at the pseudo-code it produces
1.
```
if (
```
2.
```
(event.getField('[octet_1]')==0) ||
```
3.
```
(
```
4.
```
(event.getField('[octet_1]')==10)||
```
5.
```
(
```
6.
```
(event.getField('[octet_1]')==127)||
```
7.
```
(
```
8.
```
(
```
9.
```
(event.getField('[octet_1]')==100)&&
```
10.
```
(
```
11.
```
(event.getField('[octet_2]')>=64)&&(event.getField('[octet_2]')<=127)
```
12.
```
)
```
13.
```
)||
```
14.
```
(
```
15.
```
(
```
16.
```
(event.getField('[octet_1]')==172)&&
```
17.
```
(
```
18.
```
(event.getField('[octet_2]')>=16)&&(event.getField('[octet_2]')<=31)
```
19.
```
)
```
20.
```
)||
```
21.
```
(
```
22.
```
(
```
23.
```
(event.getField('[octet_1]')==192)&&(event.getField('[octet_2]')==168)
```
24.
```
)||
```
25.
```
(
```
26.
```
(event.getField('[octet_1]')==169)&&(event.getField('[octet_2]')==254)
```
27.
```
)
```
28.
```
)
```
29.
```
)
```
30.
```
)
```
31.
```
)
```
32.
```
)
```
33.
```
)
```
Line 2 evaluates false, so it has to evaluate 3 through 31. 4 is false, so it must evaluate 5 through 30. 6 is false, so it moves onto 7 to 29. 9 is false, so it moves onto 13. 16 is false, so it moves onto 20. 23 should evaluate true, so 21 through 28 evaluates true, so 7 through 29 evaluates true, so the whole thing evaluates true.
---
### Author:  [@masech](https://discuss.elastic.co/u/masech)
#### Post date: [August 8, 2020, 8:59pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/10 "2020-08-08T20:59:02Z")
All the same, it's not a matter of logical operations in conditions. The condition in the text version is the same as in the compiled version. Аll logical operations are correct.
If true, then drop. But this does not happen with `convert_datatype`.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 8, 2020, 10:09pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/11 "2020-08-08T22:09:05Z")
> [@masech](#):
>
> But this does not happen with `convert_datatype` .
And yet the conversion does take place. I am unable to reproduce this.
---
### Author:  [@masech](https://discuss.elastic.co/u/masech)
#### Post date: [August 10, 2020, 7:57pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/12 "2020-08-10T19:57:20Z")
It's funny.
Updated logstash to version 7.8.1. Did not help.
Updated openjdk to version "11.0.2". Didn't help either.
And then I tried this:
```auto
input {
stdin { }
}
filter {
#split IPv4 address into octets
dissect {
mapping => {
"message" => "%{octet_1}.%{octet_2}.%{octet_3}.%{octet_4}"
}
convert_datatype => {
"octet_1" => "int"
"octet_2" => "int"
"octet_3" => "int"
"octet_4" => "int"
}
}
if ([octet_1] != 0) {
#add field 'TRUE' if 'octet_1' is not zero
mutate {
add_field => {
"TRUE" => "Get True"
}
}
} else {
#add field 'FALSE' if 'octet_1' is zero
mutate {
add_field => {
"FALSE" => "Get False"
}
}
}
}
output {
stdout { codec => rubydebug }
}
```
Result:
```auto
1.0.0.0
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"TRUE" => "Get True",
"@version" => "1",
"@timestamp" => 2020-08-10T19:46:00.213Z,
"host" => "elk",
"octet_1" => 1,
"octet_3" => 0,
"message" => "1.0.0.0",
"octet_4" => 0,
"octet_2" => 0
}
0.0.0.0
{
"TRUE" => "Get True",
"@version" => "1",
"@timestamp" => 2020-08-10T19:46:21.353Z,
"host" => "elk",
"octet_1" => 0,
"octet_3" => 0,
"message" => "0.0.0.0",
"octet_4" => 0,
"octet_2" => 0
}
```
Kak tebe takoe, Badger? 🙂
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 10, 2020, 8:56pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/13 "2020-08-10T20:56:36Z")
That is very, very strange.
Taking a wild stab in the dark, can you disable java\_execution?
---
### Author:  [@masech](https://discuss.elastic.co/u/masech)
#### Post date: [August 11, 2020, 6:36am UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/14 "2020-08-11T06:36:24Z")
Yeah! Disabled setting pipeline.java\_execution in /etc/logstash/logstash.yml file. And this helped:
```auto
max@elk:/usr/share/logstash$ sudo bin/logstash -f conf.d/test_convert_datatype.conf --path.settings /etc/logstash
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2020-08-11T09:23:11,596][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-08-11T09:23:12,085][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.8.1"}
[2020-08-11T09:23:30,418][INFO][org.reflections.Reflections] Reflections took 304 ms to scan 1 urls, producing 21 keys and 41 values
[2020-08-11T09:23:39,721][INFO][logstash.pipeline] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.sources"=>["/usr/share/logstash/conf.d/test_convert_datatype.conf"]}
[2020-08-11T09:23:40,725][INFO][logstash.pipeline] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#"}
The stdin plugin is now waiting for input:
[2020-08-11T09:23:41,044][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2020-08-11T09:23:42,300][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
1.0.0.0
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"host" => "elk",
"octet_1" => 1,
"octet_2" => 0,
"TRUE" => "Get True",
"@version" => "1",
"message" => "1.0.0.0",
"@timestamp" => 2020-08-11T06:25:31.219Z,
"octet_3" => 0,
"octet_4" => 0
}
0.0.0.0
{
"host" => "elk",
"octet_1" => 0,
"octet_2" => 0,
"@version" => "1",
"message" => "0.0.0.0",
"@timestamp" => 2020-08-11T06:25:40.687Z,
"octet_3" => 0,
"octet_4" => 0,
"FALSE" => "Get False"
}
```
What was that?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 11, 2020, 2:44pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/15 "2020-08-11T14:44:22Z")
It is clearly a bug. You could open an issue on github, but I do not think anyone from elastic reviews new issues there, so it will probably never get addressed.
---
### Author:  [@masech](https://discuss.elastic.co/u/masech)
#### Post date: [August 11, 2020, 8:55pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/16 "2020-08-11T20:55:07Z")
Hello Badger.
Thanks for the help. I read here [https://www.elastic.co/blog/logstash-6-5-0-released](https://www.elastic.co/blog/logstash-6-5-0-released) that in version 6.5.0 java execution has been upgraded to beta. Didn't find up-to-date information for the current status. Just in case, I opened the issue on github [https://github.com/logstash-plugins/logstash-filter-dissect/issues/73](https://github.com/logstash-plugins/logstash-filter-dissect/issues/73)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 11, 2020, 9:09pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/17 "2020-08-11T21:09:49Z")
java\_execution became the default in 7.0. At some point the ruby engine will be removed. Not sure on the timeline for that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 8, 2020, 9:09pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228/18 "2020-09-08T21:09:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.