Conditional with regex failing

[ElasticLiver (Dense Man)]

Hi Im trying to replace a value whenever the the characters ":" are present in the category field, but I get an error, I tried to scape the colon, but I get an error too

if [category] =~ /:\\/ { mutate { replace => [ "category", "Discos" ]}}

this is one of the falues in the field category

MIN-MARC0_E:\Mail-LOG\JLN-MBX01

What will be te problem?

[Badger]

@ElasticLiver

I get an error

What error do you get?

[ElasticLiver (Dense Man)]

Hi Badger, this is the error that I get

  {
    :action=>LogStash: :PipelineAction: :Create/pipeline_id:sitesmincalert,
    :exception=>"LogStash::ConfigurationError",
    :message=>"Expected one of [ \\t\\r\\n], \"#\", \"and\", \"or\", \"xor\", \"nand\", \"{\" at line 50, column 20 (byte 1496) after filter {\n\n         mutate {\n                 add_field => { \"fuente\" => \"sitescope\" }\n                 add_field => { \"severity\" => \"5\" }\n                 add_field => { \"severity_name\" => \"CRITICAL\" }\n        }\n\n        mutate {\n                convert => {\"severity\" => \"integer\"}\n        }\n\n        if [grupo] == \"MINJU_URLs Internas\"{\n\t\tmutate {\n\t\tadd_field => { \"category\" => \"urls\" }\n\t\t }\n\t}else{\n\t\tgrok { \n\t\t    match => [ \"monitor\" , \"%{DATA:cliente}_%{DATA:source}_%{GREEDYDATA:category}\"]\n\t\t    match => [ \"monitor\" , \"%{DATA:cliente}-%{DATA:source}_%{GREEDYDATA:category}\"]\n\t\t}\n\t}\n\n\tif [category] =~ /Disco_([A-Z])/ { mutate { replace => [ \"category\", \"Discos\" ]}}\n\n\tif [category] =~ /Filesystem_/ { mutate { replace => [ \"category\", \"Discos\" ]}}\n\n\tif [category] =~ /:\\\\/ { mutate { replace => [ \"category\", \"Discos\" ]}}\n\t\n\tif [category] =~ /",
    :backtrace=>[
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'",
      "org/jruby/RubyArray.java:2580:in `map'",
      "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'",
      "org/logstash/execution/AbstractPipelineExt.java:161:in `initialize'",
      "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'",
      "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:27:in `initialize'",
      "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'",
      "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"
    ]
  }

[Badger]

That is an interesting bug. Just as you cannot have a backslash at the end of a quoted string, you cannot have a backslash at the end of a regexp. The parser (as I understand it) uses the second backslash to escape the forward slash and then it all goes pear shaped. The workaround is to match zero or more of any character after the backslash.

if [category] =~ /:\\.*/

There are multiple related issues already open on the way the parser treats backslashes in the configuration.

[ElasticLiver (Dense Man)]

interesting in deed, my edit window, and what I really write

[Badger]

Put back ticks around things to prevent them being interpreted like that. If you write

`:\`

It will appear as :\