# Conditional filtering by source with IP addresses **URL:** \ **Category:** Logstash\ **Created:** [March 13, 2017, 2:03pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351 "2017-03-13T14:03:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rayl7786](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rayl7786](https://discuss.elastic.co/u/rayl7786)\ **Post date:** [March 13, 2017, 2:03pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/1 "2017-03-13T14:03:43Z")
Hello, First, I would like to apologize if I do not add enough data but can add more if needed. I have created logstash filters to check if the source has the source IP in it. (ex. /var/log/XX.XX.XX.XX/\*.log) but I am running into an issue where it matches multiple IP addresses. if [source] =~ /XX.XX.XX.4/ { mutate { add\_tag =\> ["HOSTNAME"] } } This will end up matching with others which have similar Ip address such as /XX.XX.XX.46/. So anything in the 40s would match the .4 and be tagged. I have tried == instead of =~ but that did not work. Is there a way to have the filter specifically equal the IP and not get tagged to others? Let me know if any other information is needed. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 14, 2017, 6:39am UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/2 "2017-03-14T06:39:40Z")
If you're looking for equality don't use a regular expression. ``` if [source] == "XX.XX.XX.4" { ``` ---
**Author:** ![rayl7786](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rayl7786](https://discuss.elastic.co/u/rayl7786)\ **Post date:** [March 14, 2017, 12:12pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/3 "2017-03-14T12:12:58Z")
Thank you, I will try this way. I didn't think it would work since the source actually equals /var/log/xx.xx.xx.4/[date].log I will update to see how it goes. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 14, 2017, 12:31pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/4 "2017-03-14T12:31:36Z")
Oh, sorry. Then you indeed need a regular expression but you need to make it more exact, e.g. like this: ``` if [source] =~ /\/XX\.XX\.XX\.4\// { ``` (Note how slashes inside the expression need to be escaped.) ---
**Author:** ![rayl7786](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rayl7786](https://discuss.elastic.co/u/rayl7786)\ **Post date:** [March 14, 2017, 1:04pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/5 "2017-03-14T13:04:15Z")
When I tried the last example provided, I get a syntax error when testing config. > SyntaxError: (eval):7704: syntax error, unexpected null > if (((event.get("[source]") =~ ///XX.XX.XX.8///))) # if [source] =~ "//XX.XX.XX.8//" > ^ > eval at org/jruby/RubyKernel.java:1079 > initialize at /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:65 > execute at /usr/share/logstash/logstash-core/lib/logstash/runner.rb:252 > run at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67 > run at /usr/share/logstash/logstash-core/lib/logstash/runner.rb:183 > run at /usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132 > (root) at /usr/share/logstash/lib/bootstrap/environment.rb:71 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 14, 2017, 2:10pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/6 "2017-03-14T14:10:34Z")
I left in a double quote that shouldn't have been there. I've edited my post to reflect this. It seems you're using double quotes on both sides of the expression. Don't do that. The error message indicates that the `source' field is unset. Are you sure it's set? ---
**Author:** ![rayl7786](https://avatars.discourse-cdn.com/v4/letter/r/a5b964/32.png) [@rayl7786](https://discuss.elastic.co/u/rayl7786)\ **Post date:** [March 14, 2017, 5:36pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/7 "2017-03-14T17:36:11Z")
After removing the double quotes, it looks to be working as expected. Thank you for everything! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 11, 2017, 5:36pm UTC](https://discuss.elastic.co/t/conditional-filtering-by-source-with-ip-addresses/78351/8 "2017-04-11T17:36:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.