# Logstash if \>= causes logstash to crash

**URL:** https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547
**Category:** Logstash
**Created:** [September 30, 2020, 4:59pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547 "2020-09-30T16:59:11Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [September 30, 2020, 4:59pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547/1 "2020-09-30T16:59:11Z")

</div>

Hi,

I am on ES 7.9.2, i am writing a logstash parser to add a severity based on the risk level.  
The risk\_score is between 0-10 and can be to 1 decimal place

```auto
mutate {
convert => { "risk_score" => "float" }
        }
if [risk_score] == 0 {
          mutate {
            add_field => { "[vulnerability][severity]" => "info" }
          }
        }

```

With == 0 and a risk\_score of 9.3 logstash is ok. If i use \>= then logstash will stop processing events.  
ie

```auto
if [risk_score] >= 6 and [risk_score] < 7
          mutate {
            add_field => { "risk_level" => "critical" }
        }
      }

```

I cannot see what i am doing wrong with this or why it is failing. Any ideas?

I tried converting to integer but it still failed, once i removed the if code and restarted logstash the events came through but risk\_score was still a decimal.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 30, 2020, 6:15pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547/2 "2020-09-30T18:15:55Z")

</div>

> [@probson](#):
>
> ```auto
> if [risk_score] >= 6 and [risk_score] < 7
> mutate {
> add_field => { "risk_level" => "critical" }
> }
> }
> 
> ```

You know you are missing a { on the if line, right?

---

<div class="post-metadata">

### Author: ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [September 30, 2020, 6:44pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547/3 "2020-09-30T18:44:39Z")

</div>

@Badger

sorry thats my poor copy/paste. Logstash is refreshing with success, its only when an event that hits that part of the pipeline it fails.

Ive found another post that states that mutate runs in a specific order, its possible that the convert happens to early in the mutate. Ive seperated the convert into a seperate mutate and see what happens.

---

<div class="post-metadata">

### Author: ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)
#### Post date: [September 30, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547/4 "2020-09-30T19:07:16Z")

</div>

Problem solved, the mutate built in order was the issue, seperate mutate after with the convert and the if statements are working.

[https://discuss.elastic.co/t/howto-integer-comparison-in-logstash-filter/175675/2](https://scanmail.trustwave.com/?c=4062&d=lNP036HobWcwXH5fXHwROHqSytGCw0wDu2pUfZCxQw&s=1103&u=https%3a%2f%2fdiscuss%2eelastic%2eco%2ft%2fhowto-integer-comparison-in-logstash-filter%2f175675%2f2)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-if-causes-logstash-to-crash/250547/5 "2020-10-28T19:07:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.