# Case insensitive regex match with custom grok pattern

**URL:** <https://discuss.elastic.co/t/case-insensitive-regex-match-with-custom-grok-pattern/154280>\
**Category:** Logstash\
**Created:** [October 27, 2018, 9:33am UTC](https://discuss.elastic.co/t/case-insensitive-regex-match-with-custom-grok-pattern/154280 "2018-10-27T09:33:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [October 27, 2018, 9:33am UTC](https://discuss.elastic.co/t/case-insensitive-regex-match-with-custom-grok-pattern/154280/1 "2018-10-27T09:33:53Z")

</div>

Hi!

I have a log with several fields. From those, I have one quoted string which needs to be matched against a regular expression pattern (case insensitive) and depending on the result I need to add a new field while keeping the original one too. The pattern is rather long (more than 500 chars) and most likely will grow over time. I'd like to keep the Logstash configuration file as readable and simple as possible.  
As far as I got, I can't do that simply using a custom grok pattern because it can't be set to case insensitive. The best solution I got is ... more like a hack than a real solution. Is there any way I can make it more elegant?

```auto
grok { match => ["message", "... %{QS:foo} ..."] }
mutate { add_field => ["foo_tomatch", "%{foo}"] }
mutate { lowercase => ["foo_tomatch"] }
grok {
  patterns_dir => ["./patterns"] }
  match => ["foo_tomatch", "%{MYPATTERN:foo_new}"]
  }
if [foo_new] { 
  mutate { replace => { "foo_new" => "true" } }
} else {
  mutate { replace => { "foo_new" => "false" } }
}
mutate { remove_field => ["foo_tomatch"] }

```

Thank you!

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [November 14, 2018, 4:12pm UTC](https://discuss.elastic.co/t/case-insensitive-regex-match-with-custom-grok-pattern/154280/2 "2018-11-14T16:12:06Z")

</div>

Did I hit a wall on this guys?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 12, 2018, 4:12pm UTC](https://discuss.elastic.co/t/case-insensitive-regex-match-with-custom-grok-pattern/154280/3 "2018-12-12T16:12:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.