# Ruby Shenanigans

**URL:** https://discuss.elastic.co/t/ruby-shenanigans/192341
**Category:** Logstash
**Created:** [July 26, 2019, 1:06am UTC](https://discuss.elastic.co/t/ruby-shenanigans/192341 "2019-07-26T01:06:50Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)
#### Post date: [July 26, 2019, 1:06am UTC](https://discuss.elastic.co/t/ruby-shenanigans/192341/1 "2019-07-26T01:06:51Z")

</div>

I have this pipeline that's a bit convoluted and wanted to know if this will work. The intent is, if `old.new_duration` exists and, for example, has a value of 10, instead of it being replaced, it gets added to the value of `duration.epoch` with the sum of those two values going back into the field `old.new_duration`.

```auto
  if [old][new_duration] {
    if [old][state] == "new" {
      ruby {
        code => 'event.set("[old][new_duration]", event.get("[old][new_duration").to_i + event.get("[duration][epoch]").to_i)'
      }
    } else {
      mutate {
        add_field => {
          "state_new_duration" => "%{[old][new_duration]}"
        }
      }
    }
  }

```

I can see this happening in one of two ways, the way I'm hoping:  
Field values before ruby  
old.new\_duration: 10  
duration.epoch: 5  
Ruby code executed, field values after ruby  
old.new\_duration: 15

or, the `event.set` command immediately creates a new field, overwriting any existing before executing the math op:  
Field values before ruby  
old.new\_duration: 10  
duration.epoch: 5  
Ruby code executed, field values after ruby  
old.new\_duration: 5

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 23, 2019, 1:21am UTC](https://discuss.elastic.co/t/ruby-shenanigans/192341/2 "2019-08-23T01:21:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.