# Filter: error message and string comparison

**URL:** <https://discuss.elastic.co/t/filter-error-message-and-string-comparison/86853>\
**Category:** Logstash\
**Created:** [May 23, 2017, 6:40pm UTC](https://discuss.elastic.co/t/filter-error-message-and-string-comparison/86853 "2017-05-23T18:40:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pir1981](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@pir1981](https://discuss.elastic.co/u/pir1981)\
**Post date:** [May 23, 2017, 6:40pm UTC](https://discuss.elastic.co/t/filter-error-message-and-string-comparison/86853/1 "2017-05-23T18:40:16Z")

</div>

Hi I have an error message that I would like to drop. But my filter does not seem to ever trigger.

Message

`2017-05-23T18:24:47.644Z -- ERROR -- [main] ERROR de.komoot.photon.elasticsearch.Server - cannot install plugin: mobz/elasticsearch-head: java.io.IOException: plugin directory /photon/data/photon_data/elasticsearch/plugins/head already exists. To update the plugin, uninstall it first using --remove mobz/elasticsearch-head command`

My various attempts to catch it

```
 if 'ERROR de.komoot.photon.elasticsearch.Server - cannot install plugin: mobz/elasticsearch-head: java.io.IOException: plugin directory /photon/data/photon_data/elasticsearch/plugins/head already exists.' in [message] {
drop {}
}

if [message] =~ "ERROR de.komoot.photon.elasticsearch.Server \- cannot install plugin\: mobz\/elasticsearch\-head\: java.io.IOException\: plugin directory \/photon\/data\/photon_data\/elasticsearch\/plugins\/head already exists." ...

if 'ERROR de.komoot.photon.elasticsearch.Server \- cannot install plugin\: mobz\/elasticsearch\-head\: java.io.IOException\: plugin directory \/photon\/data\/photon_data\/elasticsearch\/plugins\/head already exists.' in [message]...

 if 'photon' in [message]...

if "photon" in [message] ...

if [message] =~ "photon" ...

if [message] =~ 'photon' ...

```

I don't seem to be able to find a good explanation on single and double quotes or on regexp vs in. Any help is welcome.

---

<div class="post-metadata">

**Author:** ![pir1981](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@pir1981](https://discuss.elastic.co/u/pir1981)\
**Post date:** [June 13, 2017, 4:21pm UTC](https://discuss.elastic.co/t/filter-error-message-and-string-comparison/86853/2 "2017-06-13T16:21:40Z")

</div>

anyone?

---

<div class="post-metadata">

**Author:** ![Kryten](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Kryten](https://discuss.elastic.co/u/Kryten)\
**Post date:** [June 13, 2017, 7:45pm UTC](https://discuss.elastic.co/t/filter-error-message-and-string-comparison/86853/3 "2017-06-13T19:45:59Z")

</div>

@pir1981

You should be able to use something like:-

```
if [message] =~ / .*ERROR.*de\.komoot\.photon\.elasticsearch\.Server.*/ {
    drop {}
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2017, 7:46pm UTC](https://discuss.elastic.co/t/filter-error-message-and-string-comparison/86853/4 "2017-07-11T19:46:04Z")

</div>

Closed on July 11, 2017, 7:46pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.