# Logstash Syntax :: Add a new field... which is the product of other fields?
**URL:** https://discuss.elastic.co/t/logstash-syntax-add-a-new-field-which-is-the-product-of-other-fields/208369
**Category:** Logstash
**Created:** [November 18, 2019, 6:23pm UTC](https://discuss.elastic.co/t/logstash-syntax-add-a-new-field-which-is-the-product-of-other-fields/208369 "2019-11-18T18:23:38Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)
#### Post date: [November 18, 2019, 6:23pm UTC](https://discuss.elastic.co/t/logstash-syntax-add-a-new-field-which-is-the-product-of-other-fields/208369/1 "2019-11-18T18:23:38Z")
Hello Lords of Logstash,
In my data, I need to add a new field that multiplies the integer values of two other fields and a constant. In other words, if I have this:
```
FieldA FieldB
================
1 5
2 4
3 9
```
And I want to do this in my filter{ } section:
```
mutate {
add_field => { "[FieldC]" => "%{[FieldA]} * %{[FieldB]} * 5" }
convert => { “FieldC” => “integer” }
}
```
To get this:
```
FieldA FieldB FieldC
==========================
1 5 25
2 4 40
3 9 135
```
But the above `mutate{}` statement treats FieldC as a string and gives me this:
```
FieldA FieldB FieldC
===============================
1 5 “1 * 5 * 5”
2 4 “2 * 4 * 5”
3 9 “3 * 9 * 5”
```
Which is obviously not what I want. And if I remove the double quotes in my `add_field` statement, Logstash promptly crashes.
Any idea how to fix this syntax? Thanks!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 18, 2019, 11:42pm UTC](https://discuss.elastic.co/t/logstash-syntax-add-a-new-field-which-is-the-product-of-other-fields/208369/2 "2019-11-18T23:42:21Z")
Use a ruby filter. I haven't tested this but it would be something like
```
ruby { code => 'event.set("FieldC", event.get("FieldA").to_i * event.get("FieldB").to_i * 5)' }
```
Obviously that will implode with errors about not being a \* operator for NilClass if either FieldA or FieldB are missing, so you might need to test that they exist.
---
### Author:  [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)
#### Post date: [November 19, 2019, 4:42pm UTC](https://discuss.elastic.co/t/logstash-syntax-add-a-new-field-which-is-the-product-of-other-fields/208369/3 "2019-11-19T16:42:04Z")
Yes! Badger, you are absolutely on the money. It took me a little time to understand the syntax, but your solution worked perfectly.
To anyone who may be following this post:
I initially thought that this syntax didn't work, because the value of "FieldC" was turning out to be 0 every time. But when I did some troubleshooting, I realized I misspelled "FieldA" in my command:
`ruby { code => 'event.set("FieldC", event.get("FeildA").to_i * event.get("FieldB").to_i * 5)' }`
When Logstash goes to look for `event.get("FeildA")`, this returns a NULL because the field doesn't exist. the `to_i` function converts NULL to 0, thus throwing off the rest of the math. Once I fixed my spelling mistake, everything else worked.
Thanks Badger!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2019, 4:42pm UTC](https://discuss.elastic.co/t/logstash-syntax-add-a-new-field-which-is-the-product-of-other-fields/208369/4 "2019-12-17T16:42:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.