# New field base on the sum of other 3 fields not working

**URL:** <https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612>\
**Category:** Logstash\
**Created:** [August 27, 2020, 12:15pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612 "2020-08-27T12:15:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [August 27, 2020, 12:15pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612/1 "2020-08-27T12:15:54Z")

</div>

Hello all,

i need some help, i can't get this working. I need to create a new file base on the sum of other three fields.

field1, field2, field3 are defined as float fields

```
ruby { code => "event['new_field'] =''" }
mutate {
    convert => ["new_field", "float"]
}
ruby { code => "event['new_field'] = event['field1'] + event['field2'] + event['field3']" }

```

what am i doing wrong?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 27, 2020, 1:28pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612/2 "2020-08-27T13:28:40Z")

</div>

For a start you don't need the first ruby and the mutate filter. Creating an empty field and trying to convert it to float is unnecessary, as it gets overwritten immediately after that anyway. Furthermore you are using the wrong syntax to access the event fields (unless you are using a very old version of Logstash). Have a look at the Event API: [https://www.elastic.co/guide/en/logstash/current/event-api.html](https://www.elastic.co/guide/en/logstash/current/event-api.html)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 27, 2020, 1:28pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612/3 "2020-08-27T13:28:45Z")

</div>

```auto
input {
  generator {
    lines => [
     '{"field1": 1, "field2": 2, "field3": 3}'
    ]
    count => 1
    codec => "json"
  }
}
filter {
ruby { code => 'event.set("new_field", event.get("field1") + event.get("field2") + event.get("field3"))' }

}
output {
  stdout { codec => "rubydebug" }
}

```

OUTPUT

```auto
{
        "field3" => 3,
      "@version" => "1",
          "host" => "MacBook-Pro.domain",
     "new_field" => 6,
    "@timestamp" => 2020-08-27T13:28:09.613Z,
      "sequence" => 0,
        "field2" => 2,
        "field1" => 1
}

```

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [August 27, 2020, 3:17pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612/4 "2020-08-27T15:17:46Z")

</div>

Thank you so much, works perfectly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2020, 3:17pm UTC](https://discuss.elastic.co/t/new-field-base-on-the-sum-of-other-3-fields-not-working/246612/5 "2020-09-24T15:17:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.