# Save a value to variable

**URL:** <https://discuss.elastic.co/t/save-a-value-to-variable/47642>\
**Category:** Logstash\
**Created:** [April 18, 2016, 10:25am UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642 "2016-04-18T10:25:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prateek\_Kshtriya](https://avatars.discourse-cdn.com/v4/letter/p/c37758/32.png) [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\
**Post date:** [April 18, 2016, 10:25am UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642/1 "2016-04-18T10:25:22Z")

</div>

Hi All,

Please suggest If it is possible to do a grok & perform a mathematical operation on grok result?

Regards,  
Prateek

---

<div class="post-metadata">

**Author:** ![KlavsKlavsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/klavsklavsen/32/74145_2.png) [@KlavsKlavsen](https://discuss.elastic.co/u/KlavsKlavsen)\
**Post date:** [April 18, 2016, 10:26am UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642/2 "2016-04-18T10:26:54Z")

</div>

I do that.. by using the ruby filter (and then do it in ruby 🙂

---

<div class="post-metadata">

**Author:** ![Prateek\_Kshtriya](https://avatars.discourse-cdn.com/v4/letter/p/c37758/32.png) [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\
**Post date:** [April 18, 2016, 11:35am UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642/3 "2016-04-18T11:35:02Z")

</div>

Hey Klavs,

Thank you for the update.  
I have not done it before , could you please post some snippet of logstash config file or any specific link to the same.  
It would be great help.

Thank you.

---

<div class="post-metadata">

**Author:** ![KlavsKlavsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/klavsklavsen/32/74145_2.png) [@KlavsKlavsen](https://discuss.elastic.co/u/KlavsKlavsen)\
**Post date:** [April 18, 2016, 12:03pm UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642/4 "2016-04-18T12:03:11Z")

</div>

Will give you a sha1 has of 'message' field - and add field called message\_id containing the result (which I then use in my output to ES as document\_id).

code section is pure ruby - and has access to parts of the current logline being processed through event.

filter {  
ruby {  
init =\> "require 'digest/sha1'"  
code =\> "event['message\_id'] = Digest::SHA1.base64digest(event['message'])"  
}  
}

---

<div class="post-metadata">

**Author:** ![Prateek\_Kshtriya](https://avatars.discourse-cdn.com/v4/letter/p/c37758/32.png) [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\
**Post date:** [April 19, 2016, 10:32am UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642/5 "2016-04-19T10:32:30Z")

</div>

Thank you .  
I am trying to implement on my problem statement.

Regards.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/save-a-value-to-variable/47642/6 "2017-07-06T05:01:36Z")

</div>

Closed on July 6, 2017, 5:01am UTC