Conditional with regex failing

Hi Im trying to replace a value whenever the the characters ":" are present in the category field, but I get an error, I tried to scape the colon, but I get an error too

if [category] =~ /:\\/ { mutate { replace => [ "category", "Discos" ]}}

this is one of the falues in the field category


What will be te problem?

What error do you get?

1 Like

Hi Badger, this is the error that I get

    :action=>LogStash: :PipelineAction: :Create/pipeline_id:sitesmincalert,
    :message=>"Expected one of [ \\t\\r\\n], \"#\", \"and\", \"or\", \"xor\", \"nand\", \"{\" at line 50, column 20 (byte 1496) after filter {\n\n         mutate {\n                 add_field => { \"fuente\" => \"sitescope\" }\n                 add_field => { \"severity\" => \"5\" }\n                 add_field => { \"severity_name\" => \"CRITICAL\" }\n        }\n\n        mutate {\n                convert => {\"severity\" => \"integer\"}\n        }\n\n        if [grupo] == \"MINJU_URLs Internas\"{\n\t\tmutate {\n\t\tadd_field => { \"category\" => \"urls\" }\n\t\t }\n\t}else{\n\t\tgrok { \n\t\t    match => [ \"monitor\" , \"%{DATA:cliente}_%{DATA:source}_%{GREEDYDATA:category}\"]\n\t\t    match => [ \"monitor\" , \"%{DATA:cliente}-%{DATA:source}_%{GREEDYDATA:category}\"]\n\t\t}\n\t}\n\n\tif [category] =~ /Disco_([A-Z])/ { mutate { replace => [ \"category\", \"Discos\" ]}}\n\n\tif [category] =~ /Filesystem_/ { mutate { replace => [ \"category\", \"Discos\" ]}}\n\n\tif [category] =~ /:\\\\/ { mutate { replace => [ \"category\", \"Discos\" ]}}\n\t\n\tif [category] =~ /",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'",
      "org/jruby/ `map'",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'",
      "org/logstash/execution/ `initialize'",
      "org/logstash/execution/ `initialize'",
      "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'",
      "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'",
      "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"

That is an interesting bug. Just as you cannot have a backslash at the end of a quoted string, you cannot have a backslash at the end of a regexp. The parser (as I understand it) uses the second backslash to escape the forward slash and then it all goes pear shaped. The workaround is to match zero or more of any character after the backslash.

if [category] =~ /:\\.*/

There are multiple related issues already open on the way the parser treats backslashes in the configuration.

1 Like

interesting in deed, my edit window, and what I really write

Put back ticks around things to prevent them being interpreted like that. If you write


It will appear as :\

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.