# Ruby filter condition

**URL:** <https://discuss.elastic.co/t/ruby-filter-condition/96722>\
**Category:** Logstash\
**Created:** [August 11, 2017, 8:02am UTC](https://discuss.elastic.co/t/ruby-filter-condition/96722 "2017-08-11T08:02:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sureshboiina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sureshboiina/32/79183_2.png) [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)\
**Post date:** [August 11, 2017, 8:02am UTC](https://discuss.elastic.co/t/ruby-filter-condition/96722/1 "2017-08-11T08:02:57Z")

</div>

Hi

I having a data like  
status,id  
0,A  
2,B  
3,C  
A,D  
B,E  
6,N  
Based on status value need to add one more field and insert good,bad in new field  
**if status is even number then new field value is good else status is alphabet and odd number than new field value is bad**

**Expected output**  
status,id,New\_satus  
0,A,Good  
2,B,Good  
3,C,Bad  
A,D,Bad  
B,E,Bad  
6,N,Good

Used this code in filter(using logstash 5.0)  
ruby {  
code =\> "if event.get('status') % 2 ==0 event.set('STATUS', "Good") else event.set('STATUS', "Bad")"  
}  
But not able to fulfill can u guys please help on this is this possible

And can you please provide me the ruby filter reference doc link for further use.

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2017, 9:00am UTC](https://discuss.elastic.co/t/ruby-filter-condition/96722/2 "2017-08-11T09:00:18Z")

</div>

The `status` field is obviously a string field so you can't just use `%` on it. You have to convert it to an integer first, but that conversion will of course fail if the field doesn't contain an integer so you'd have to deal with that. If the number is always a single digit then things get very easy:

```
event.set('status', ["0", "2", "4", "6", "8"].include?(event.get('status')) ? "good" : "bad")

```

> And can you please provide me the ruby filter reference doc link for further use.

Documentation of all Logstash filters is available from [https://www.elastic.co](https://www.elastic.co).

---

<div class="post-metadata">

**Author:** ![sureshboiina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sureshboiina/32/79183_2.png) [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)\
**Post date:** [August 11, 2017, 9:57am UTC](https://discuss.elastic.co/t/ruby-filter-condition/96722/3 "2017-08-11T09:57:39Z")

</div>

Hi

Thanks for your swift reply but i will have more than one digit some times so done like

```
grok{
           match => { "status" => "%{INT:num}"} 
              }

           mutate{
	       convert => {"num" => "integer" }
	             }
    
	       ruby {
	       code => 'event.get("num") % 2 == 0 ? event.set("STATUS", "Good") : event.set("STATUS", "Bad")'
                }
	
              #failure when it is alphabet then can make as bad
	       if "_grokparsefailure" in [tags]{
	       mutate{
	       add_field => { "STATUS" => "Bad" }
	             }

```

**About ruby filter i didn't see much in elastic documentation can you share me the link where can i find it.**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2017, 9:57am UTC](https://discuss.elastic.co/t/ruby-filter-condition/96722/4 "2017-09-08T09:57:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.