# Detect if event.get("message").scan fails

**URL:** <https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818>\
**Category:** Logstash\
**Created:** [March 24, 2020, 11:30am UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818 "2020-03-24T11:30:12Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [March 24, 2020, 11:30am UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/1 "2020-03-24T11:30:12Z")

</div>

Hello All,

i would like to detect if "pattternmatch4" fails and do another process. How can i detect if it fails?

```
      ruby { code => 'event.set("patternmatch3", 
                      event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/))'
      }

      ruby { code => 'event.set("patternmatch4", 
                      event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/))'
      }

```

Best

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2020, 12:45pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/2 "2020-03-24T12:45:52Z")

</div>

If scan does not match anything I believe it will return nil, so you can test for that.

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [March 24, 2020, 12:50pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/3 "2020-03-24T12:50:35Z")

</div>

Thank you Badger,

could you give a code example? Maybe with and if statement, i am a newbie handling ruby

Best

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [March 24, 2020, 2:46pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/4 "2020-03-24T14:46:52Z")

</div>

My try is not working,

```
  if [patternmatch4] == nil {

  } else { 
     
  }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2020, 2:50pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/5 "2020-03-24T14:50:41Z")

</div>

Try something like

```
ruby {
    code => '
        p = event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/)
        if p
            event.set("patternmatch4", p)
        end
    '
}
```

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [March 24, 2020, 6:31pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/6 "2020-03-24T18:31:47Z")

</div>

Thanks Badger,

how can set a "0" value to "patternmatch4" if not match?. My try is not working...

```
ruby { code => '

                x = "0"
                p = event.get("message").scan(/text.*?(\w[\w,.]*)\r?$/)

                if p
                  event.set("patternmatch4", p)
                else
                  event.set("patternmatch4", x)
                end 
        '
  }

   mutate {
    add_field => {"field" => "%{[patternmatch4][-1]}"}
   }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2020, 6:48pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/7 "2020-03-24T18:48:00Z")

</div>

I would expect that to work. What does patternmatch4 get set to?

---

<div class="post-metadata">

**Author:** ![nino](https://avatars.discourse-cdn.com/v4/letter/n/b9bd4f/32.png) [@nino](https://discuss.elastic.co/u/nino)\
**Post date:** [March 24, 2020, 6:53pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/8 "2020-03-24T18:53:41Z")

</div>

> [@Badger](#):
>
> I would expect that to work. What does patternmatch4 get set to?

I' added more code to my example, what i need if the pattern is not matching i set a value of "0" on a field in the document. The pattern is can be match with several lines. The [-1] is because if matched i want to retrieve tha last match in the patternmatch4 array.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2020, 6:53pm UTC](https://discuss.elastic.co/t/detect-if-event-get-message-scan-fails/224818/9 "2020-04-21T18:53:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.