# Beginner question - searching for string containing \[\] chars

**URL:** <https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 23, 2017, 7:52am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696 "2017-03-23T07:52:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![msr](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@msr](https://discuss.elastic.co/u/msr)\
**Post date:** [March 23, 2017, 7:52am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696/1 "2017-03-23T07:52:22Z")

</div>

I've just installed filebeats and I am trying to configure it to include\_lines that contain square brackets. For example, the log file entry would be something like "Storage swapped on [DBName].[TableName1]".

I tried configuring the yml as follows, but this isn't working:  
#include\_lines: ["^ERR", "^WARN"]  
include\_lines: ["Storage swapped on [DBName].[TableName1]", "Error", "ERROR"]

If I remove the square brackets from the string it works, but this gives me messages for all tables:  
include\_lines: ["Storage swapped"]

So I am assuming it's the square brackets it doesn't like? Do I need to escape these characters, and if so how?!

Thanks!

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [March 23, 2017, 8:02am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696/2 "2017-03-23T08:02:06Z")

</div>

Hi Mark,

include\_lines uses regular expressions (take a look to the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#include-lines)), most likely you want to escape brackets, using the escape char '':

```
include_lines: ["Storage swapped on \[DBName\]\.\[TableName1\]", "Error", "ERROR"]

```

Give it a try 😉

---

<div class="post-metadata">

**Author:** ![msr](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@msr](https://discuss.elastic.co/u/msr)\
**Post date:** [March 23, 2017, 8:30am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696/3 "2017-03-23T08:30:21Z")

</div>

Thanks for the prompt response Carlos, but I'm still doing something wrong!

If I put the escape char inside the double quotes like this, the service won't start.

The filebeat\_Responses service failed to start due to the following error:  
The service did not respond to the start or control request in a timely fashion.

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [March 23, 2017, 8:53am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696/4 "2017-03-23T08:53:45Z")

</div>

Sorry my bad,

I forgot to switch to single quotes for the regular expression:

```
include_lines: ['Storage swapped on \[DBName\]\.\[TableName1\]', 'Error', 'ERROR']
```

---

<div class="post-metadata">

**Author:** ![msr](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@msr](https://discuss.elastic.co/u/msr)\
**Post date:** [March 23, 2017, 10:44am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696/5 "2017-03-23T10:44:54Z")

</div>

Ah - that's solved it! Thanks!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 20, 2017, 10:44am UTC](https://discuss.elastic.co/t/beginner-question-searching-for-string-containing-chars/79696/6 "2017-04-20T10:44:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.