# Ruby filter plugin does not read new field values
**URL:** https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343
**Category:** Logstash
**Created:** [September 4, 2021, 1:20pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343 "2021-09-04T13:20:09Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)
#### Post date: [September 4, 2021, 1:20pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/1 "2021-09-04T13:20:09Z")
How to get correct value of the field inside ruby code in logstash pipeline?
**sample 1:**
```auto
input {
elasticsearch {
hosts => "http://localhost:9200"
index => "test1"
}
}
filter {
mutate {
add_field => { "yearsdiff" => "10" }
add_field => { "timestampdiff1" => "" }
}
ruby {
code => '
event.set("[timestampdiff1]", event.get("[yearsdiff]"));
'
}
}
output {
elasticsearch {
hosts => "http://localhost:9200/"
index => "test1"
action => "update"
document_id => "%{docid}"
doc_as_upsert => true
}
}
```
Output :
`"timestampdiff1" : 0`
**sample 2:**
Same as above. Only used add\_field inside ruby instead of mutate.
Output:
`"timestampdiff1" : null`
Expected output:
`"timestampdiff1" : 10`
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 4, 2021, 2:14pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/2 "2021-09-04T14:14:08Z")
Where are you planning on getting `yearsdiff` value from? Or is it always 10?
---
### Author:  [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)
#### Post date: [September 4, 2021, 2:31pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/3 "2021-09-04T14:31:57Z")
@aaron-nimocks ,
Yes, its always 10.
Actually I want to calculate ( currentYear - yearsDiff ) in timestampdiff1 field but I always get 2021.
---
### Author:  [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 4, 2021, 3:12pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/4 "2021-09-04T15:12:24Z")
If I read correctly and your goal is to get current year and subtract 10 then this how I would do it.
```auto
ruby {
code => '
event.set("year_diff", ((Time.now().to_s[0..3]).to_i) - 10)
'
}
```
This takes the current system time -\> transforms to a string -\> using substring function extract the first 4 characters which is the year -\> convert back to an integer so you can do math functions -\> subtract 10 -\> save in new field called `year_diff`.
Not sure if this is the most efficient but that's just the first solution I thought of.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 4, 2021, 5:14pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/5 "2021-09-04T17:14:13Z")
I answered a closely related question from the same poster [here](https://discuss.elastic.co/t/how-to-calculate-old-date-from-today-by-subtracting-given-years-months-days-in-logstash/283349/2).
---
### Author:  [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)
#### Post date: [September 4, 2021, 5:41pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/6 "2021-09-04T17:41:57Z")
@Badger , actually this question is different. I am still not able to access add\_field values inside ruby code. Please suggest a way.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 4, 2021, 6:31pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/7 "2021-09-04T18:31:04Z")
The configuration
```
input { generator { count => 1 lines => [''] } }
filter {
mutate {
add_field => { "yearsdiff" => "10" }
add_field => { "timestampdiff1" => "" }
}
ruby { code => ' event.set("[timestampdiff1]", event.get("[yearsdiff]")) ' }
}
output { stdout { codec => rubydebug { metadata => false } } }
```
produces
```
"yearsdiff" => "10",
"message" => "",
"timestampdiff1" => "10"
```
---
### Author:  [@priyaankaa](https://discuss.elastic.co/u/priyaankaa)
#### Post date: [September 5, 2021, 7:11am UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/8 "2021-09-05T07:11:40Z")
I dont know why but in my case exact same code is giving output as `"timestampdiff1" : "0"`.
I am using ELK 7.12. Is this bug ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 5, 2021, 2:22pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/9 "2021-09-05T14:22:25Z")
I cannot think of any reason why that would happen.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 3, 2021, 2:22pm UTC](https://discuss.elastic.co/t/ruby-filter-plugin-does-not-read-new-field-values/283343/10 "2021-10-03T14:22:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.