# Conditional Input based on Regex
**URL:** https://discuss.elastic.co/t/conditional-input-based-on-regex/110834
**Category:** Logstash
**Created:** [December 8, 2017, 11:36am UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834 "2017-12-08T11:36:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@scch](https://discuss.elastic.co/u/scch)
#### Post date: [December 8, 2017, 11:36am UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834/1 "2017-12-08T11:36:35Z")
Hi, can we do conditional input to a "field" based on regex. I am able to achieve same in painless scripting but want to achieve it in Logstash.
below is example from painless.
if (doc['Mach.keyword'].value =~ /^T\d{4}WKS([0-9]+)$/) {
return "NZ";
} else if (doc['Mach.keyword'].value =~ /^\w{7}+$/) {
return "AUS";
} else if (doc['Mach.keyword'].value =~ /^\w{12}+$/) {
return "JAP";
}
return "CH";
tried through grok filter but unable to figure out syntax in documentation. Any advice or help.
Thanks You...
---
### Author:  [@paz](https://discuss.elastic.co/u/paz)
#### Post date: [December 8, 2017, 12:13pm UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834/2 "2017-12-08T12:13:28Z")
Translation should be pretty straightforward, conditionals allow for regex matching. Like so:
```auto
if [Mach] =~ /^T\d{4}WKS([0-9]+)$/ {
# do stuff
}
else if [Mach] =~ /^\w{7}+$/ {
# do stuff
}
else if [Mach] =~ /^\w{12}+$/ {
# do stuff
}
else {
# do stuff
}
```
---
### Author:  [@scch](https://discuss.elastic.co/u/scch)
#### Post date: [December 8, 2017, 12:52pm UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834/3 "2017-12-08T12:52:15Z")
thanks for responding, no luck with below statements. ☹
grok{
if [Mach] =~ /^T\d{4}WKS([0-9]+)$/ {
mutate {
add\_field =\> {"ctry" =\> "NZ"}
}
}
else {
mutate {
add\_field =\> {"ctry" =\> "AUS" }
}
}
}
**and even tried below**
grok{
if "/^T\d{4}WKS([0-9]+)$/" in [MACH] {
mutate {
add\_field =\> {"ctry" =\> "NZ" }
}
else {
mutate {
add\_field =\> {"ctry" =\> "AUS" }
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 8, 2017, 2:00pm UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834/4 "2017-12-08T14:00:55Z")
What does an example event produced by Logstash look like? Use a `stdout { codec => rubydebug }` output.
---
### Author:  [@scch](https://discuss.elastic.co/u/scch)
#### Post date: [December 11, 2017, 5:12am UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834/5 "2017-12-11T05:12:10Z")
Hey thanks guys...below code worked 😀
seems no need to mention Grok again; correct only one time is enough ?...i think that was the mistake i made...
if [Mach] =~ /^T\d{4}WKS([0-9]+)$/ {
mutate {
add\_field =\> {"ctry" =\> "NZ"}
}
}
else {
mutate {
add\_field =\> {"ctry" =\> "AUS" }
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2018, 5:12am UTC](https://discuss.elastic.co/t/conditional-input-based-on-regex/110834/6 "2018-01-08T05:12:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.