# Can I use pattern in Logstash output plugin
**URL:** https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600
**Category:** Logstash
**Created:** [January 6, 2023, 7:26am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600 "2023-01-06T07:26:17Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 6, 2023, 7:26am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/1 "2023-01-06T07:26:17Z")
Hello,
I want to track all the failures log in a file.
For Example,
```auto
if "_jsonparsefailure" in [tags] {
file {
path => "_jsonparsefailure.txt"
}
}
```
Can I use pattern like - ` if "*failure*" in [tags]`
so that I track all types of failure???
---
### Author:  [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)
#### Post date: [January 6, 2023, 10:42am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/2 "2023-01-06T10:42:23Z")
Yes, you can.
---
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 6, 2023, 1:51pm UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/3 "2023-01-06T13:51:02Z")
Thank You
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 6, 2023, 5:41pm UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/4 "2023-01-06T17:41:27Z")
> [@Rakhshunda\_Noorein\_J](#):
>
> Can I use pattern like - ` if "*failure*" in [tags]`
No, that does not work. If you run logstash with
```
input { generator { count => 1 lines => ['foo'] codec => json } }
output { stdout { codec => rubydebug { metadata => false } } }
filter { if "*failure*" in [tags] { mutate { add_field => { "matched" => true } } } }
```
then the event will have a \_jsonparsefailure tag, but will not have a [matched] field. You can use
```
if [tags][0] =~ ".*failure.*" { ...
```
but that only checks the first entry in the tags array.
---
### Author:  [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)
#### Post date: [January 9, 2023, 3:50am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/5 "2023-01-09T03:50:52Z")
Ah, I see that you were trying to pattern match. Yup, as Badger mentioned, that won't be possible. You will have to iterate through the `tags` array (if it is an array) in `ruby` filter and then add the field/flag separately.
---
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 9, 2023, 5:53am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/6 "2023-01-09T05:53:53Z")
> [@hendry.lim](#):
>
> field/flag separately.
Ok got the solution. Thank You.
---
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 9, 2023, 5:54am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/7 "2023-01-09T05:54:33Z")
Thank you for your solution.
---
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 9, 2023, 10:30am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/8 "2023-01-09T10:30:06Z")
Hello Badger,
How can I iterate through tags in my output plugin.. Is there are any ways.. Can you Please provide me with..
I want to do something like this....
```auto
output {
[tags].each_index { |x|
if [tags][x] =~ ".*failure.*"
{
elasticsearch {
hosts => ["myhost"]
user => "username"
password => "password"
index => "error-log"
}
}
}
}
```
this is giving error in config..
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 9, 2023, 12:07pm UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/9 "2023-01-09T12:07:23Z")
> [@Rakhshunda\_Noorein\_J](#):
>
> How can I iterate through tags in my output plugin.. Is there are any ways.. Can you Please provide me with
This is not possible, that's why you are getting an error in config.
---
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 9, 2023, 12:42pm UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/10 "2023-01-09T12:42:49Z")
Is there an alternative to do that???
If i want to do a for each loop in filter with ruby filter, can you please provide me with the proper syntax
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 9, 2023, 12:49pm UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/11 "2023-01-09T12:49:55Z")
> [@Rakhshunda\_Noorein\_J](#):
>
> If i want to do a for each loop in filter with ruby filter, can you please provide me with the proper syntax
You can't do that in the output the only thing that you can use in output are simple conditionals.
You may use a ruby filter in the `filter` section to do that, but I do not have any code example, you may find a couple in the search of the forum.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 9, 2023, 5:40pm UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/12 "2023-01-09T17:40:06Z")
Use a ruby filter in the filter section
```
ruby {
code => '
fail = false
tags = event.get("tags")
tags.each { |v|
if v =~ /failure$/
fail = true
end
}
event.set("[@metadata][failureTag]", fail)
'
}
```
and then test [@metadata][failureTag] in the output section.
---
### Author:  [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)
#### Post date: [January 10, 2023, 7:30am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/13 "2023-01-10T07:30:27Z")
Thank You so much badger. It worked as I wanted. I really appreciate your effort. Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2023, 7:30am UTC](https://discuss.elastic.co/t/can-i-use-pattern-in-logstash-output-plugin/322600/14 "2023-02-07T07:30:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.