# Logstash Syntax :: Check Boolian Value within a Field?

**URL:** <https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530>\
**Category:** Logstash\
**Created:** [June 17, 2020, 7:48pm UTC](https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530 "2020-06-17T19:48:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [June 17, 2020, 7:48pm UTC](https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530/1 "2020-06-17T19:48:02Z")

</div>

Hi Logstash Ninjas,

In my filter{} section, I think I am creating a field with a Boolean value in it:

```
if SOME CONDITION {
  mutate {
    add_field => { "MyFlag" => 'true' }
    convert => { "MyFlag" => "boolean" }
  }
}
else {
  mutate {
    add_field => { "MyFlag" => 'false' }
    convert => { "MyFlag" => "boolean" }
  }
}

```

Later on, I want to check that flag:

```
if "MyFlag" == 'true' {
  mutate {
    add_field => { "Result" => "Boolean check worked!" }
  }
}
else {
  mutate {
    add_field => { "Result" => "Boolean check failed..." }
  }
}

```

In my tests, I’ve hard-coded MyFlag to always be TRUE. But that if() statement always fails. I can’t figure out the syntax should be. Any ideas?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 17, 2020, 8:33pm UTC](https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530/2 "2020-06-17T20:33:37Z")

</div>

Right now you are comparing the two strings "MyFlag" and "true" with each other. The correct syntax is  
`if [MyFlag] { ... }`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 17, 2020, 9:05pm UTC](https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530/3 "2020-06-17T21:05:43Z")

</div>

mutate runs operations in a [fixed order](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order). add\_field is part of decoration, which is the last thing done to the event. So at the time you try to convert it to boolean [MyFlag] does not exist.

Use two mutate filters in each branch.

---

<div class="post-metadata">

**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Post date:** [June 18, 2020, 2:57pm UTC](https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530/4 "2020-06-18T14:57:19Z")

</div>

Yes! You are so right. This worked perfectly. Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2020, 2:57pm UTC](https://discuss.elastic.co/t/logstash-syntax-check-boolian-value-within-a-field/237530/5 "2020-07-16T14:57:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.