# Condicional if with Regex
**URL:** https://discuss.elastic.co/t/condicional-if-with-regex/328417
**Category:** Logstash
**Created:** [March 24, 2023, 4:05am UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417 "2023-03-24T04:05:03Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)
#### Post date: [March 24, 2023, 4:05am UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417/1 "2023-03-24T04:05:03Z")
Hi everybody,
Does anyone know how can I build a "if" condicional that logstash change de number "1" to string "Worked" ?
As example, the input are lines like:
> hello,ola,1hi, **1**
> **1** ,red1, **1** ,green
> **1**
> ...
and the output i would like is:
> hello,ola,1hi, **Worked**
> **Worked** ,red1, **Worked** ,green
> **Worked**
> ...
I have tried many configurations but always appear a error. Example of configurations i have tried:
```auto
if [some_field] =~ /(^1$|^1,.*|*.,1,.*|*.,1$)/ {
...
```
or
```auto
if [some_field] =~ /^1$/ or [some_field] =~ /^1,.*/ or [some_field] =~ /*.,1,.*/ or [some_field] =~ /*.,1$/ {
...
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 24, 2023, 3:31pm UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417/2 "2023-03-24T15:31:36Z")
You could try using that regexp in a [mutate+gsub](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub) filter.
---
### Author:  [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)
#### Post date: [March 24, 2023, 11:55pm UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417/3 "2023-03-24T23:55:25Z")
Hi Bagder,
I gave this example to make it easier to understand but the focus is use this regexp in if conditional.
if I do your suggest, gsub will modify my "some\_field" and i dont want it.
I need to use this regexp in "if condicional" to use gsub to modify another field.
Like (this "if" does not work ☹) :
```auto
if [m3ua.message_class] =~ /(^1$|^1,.*|*.,1,.*|*.,1$)/ {
mutate {
gsub => [
"m3ua.message_type", "^1$", "DUNA_destination_unavailable_1",
"m3ua.message_type", "^1,", "DUNA_destination_unavailable_1,",
"m3ua.message_type", ",1,", ",DUNA_destination_unavailable_1,",
"m3ua.message_type", ",1$", ",DUNA_destination_unavailable_1",
"m3ua.message_type", "^2$", "DAVA_destination_available_2",
"m3ua.message_type", "^2,", "DAVA_destination_available_2,",
"m3ua.message_type", ",2,", ",DAVA_destination_available_2,",
"m3ua.message_type", ",2$", ",DAVA_destination_available_2",
"m3ua.message_type", "^3$", "DAUD_Destination_state_audit_3",
"m3ua.message_type", "^3,", "DAUD_Destination_state_audit_3,",
"m3ua.message_type", ",3,", ",DAUD_Destination_state_audit_3,",
"m3ua.message_type", ",3$", ",DAUD_Destination_state_audit_3",
"m3ua.message_type", "^4$", "SCON_SS7_signalling_congestion_state_4",
"m3ua.message_type", "^4,", "SCON_SS7_signalling_congestion_state_4,",
"m3ua.message_type", ",4,", ",SCON_SS7_signalling_congestion_state_4,",
"m3ua.message_type", ",4$", ",SCON_SS7_signalling_congestion_state_4"
]
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 25, 2023, 12:11am UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417/4 "2023-03-25T00:11:27Z")
> [@Claudio\_Ract\_Costa](#):
>
> `if [m3ua.message_class] =~ /(^1$|^1,.*|*.,1,.*|*.,1$)/ {`
You do not have to match the entire field. Try `/(^1$|^1,|,1,|,1$)/`
---
### Author:  [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)
#### Post date: [March 25, 2023, 1:21am UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417/5 "2023-03-25T01:21:46Z")
> [@Badger](#):
>
> /(^1$|^1,|,1,|,1$)/
It works Badger !!
Thanks !!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 22, 2023, 1:22am UTC](https://discuss.elastic.co/t/condicional-if-with-regex/328417/6 "2023-04-22T01:22:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.