# Can we use regex check in if conditional?
**URL:** https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786
**Category:** Logstash
**Created:** [April 27, 2018, 8:48am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786 "2018-04-27T08:48:01Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 27, 2018, 8:48am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/1 "2018-04-27T08:48:02Z")
Hi, I want to check if regex matched in if conditional then extract the line which is matched and add in ES.
if regexMatched
{
add\_field for matched lines
}
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 8:59am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/2 "2018-04-27T08:59:32Z")
The syntax for a regex condition is
```
if [field] =~ /regex/ {
...
}
```
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 27, 2018, 12:24pm UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/3 "2018-04-27T12:24:56Z")
@Jenni, how we will get only matched lines?.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 12:32pm UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/4 "2018-04-27T12:32:21Z")
Without more details about your use case that's difficult to answer. Example events and the desired output for these is always helpful.
In general, you'd probalby use grok to extract information oder kv to seperate the lines and process them seperately in a loop in ruby.
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 27, 2018, 12:50pm UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/5 "2018-04-27T12:50:37Z")
here is input file
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
[15119.753902] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753917] dhd\_check\_hang: Event HANG send up due to re=5 te=0 e=-110 s=2
[15119.753937] dhd\_prot\_ioctl : bus is down. we have nothing to do
[15119.791431] [] (schedule\_timeout+0x158/0x25c) from [] (0xea1e0000)
[15119.799331] kworker/3:2 R running 0 29597 2 0x00000000
[15119.805699] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.814384] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.822637] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.830710] kworker/u8:1 S c0ab2fd4 0 29738 2 0x00000000
[15119.837078] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.845763] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.854015] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.862088] kworker/u8:4 S c0ab2fd4 0 29739 2 0x00000000
[15119.868455] [] (\_\_schedule+0x3d0/0x8a4) from [] (worker\_thread+0x1fc/0x3dc)
[15119.877140] [] (worker\_thread+0x1fc/0x3dc) from [] (kthread+0xe0/0xe4)
[15119.885391] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
[15119.893468] Sched Debug Version: v0.10, 3.10.96+ #1
[15119.898337] ktime
and i want to match "dhd\_bus\_rxctl: rxcnt\_timeout" and dump following lines in to ES
After matching regex
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] [] (kthread+0xe0/0xe4) from [] (ret\_from\_fork+0x14/0x20)
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
15119.753889] dhd\_bus\_rxctl: rxcnt\_timeout=5, rxlen=0
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 1:08pm UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/6 "2018-04-27T13:08:57Z")
```
lines = Array.new
event.get("message").split("\n").each do |line|
lines.push(line) if line =~ /.*dhd_bus_rxctl: rxcnt_timeout.*/
end
event.set("lines", lines)
```
I think something like that could give you can array with the matching lines. But I have no idea why your second example should be in that list?
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 30, 2018, 5:37am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/7 "2018-04-30T05:37:49Z")
@Jenni, instead of using loop and iterating over whole "message" and increasing time complexity.
How can we search only those lines and get it?.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 30, 2018, 9:17am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/8 "2018-04-30T09:17:26Z")
I'm not a Ruby programmer. But maybe using scan would be faster?
```
event.set("lines", event.get("message").scan(/.*dhd_bus_rxctl: rxcnt_timeout.*/))
```
---
### Author:  [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 30, 2018, 9:49am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/9 "2018-04-30T09:49:40Z")
Thanks a lot @Jenni it worked.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 28, 2018, 9:49am UTC](https://discuss.elastic.co/t/can-we-use-regex-check-in-if-conditional/129786/10 "2018-05-28T09:49:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.