# Grok regular expression doesn't contain a word not working

**URL:** <https://discuss.elastic.co/t/grok-regular-expression-doesnt-contain-a-word-not-working/162019>\
**Category:** Logstash\
**Created:** [December 24, 2018, 5:26pm UTC](https://discuss.elastic.co/t/grok-regular-expression-doesnt-contain-a-word-not-working/162019 "2018-12-24T17:26:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![XanxusVer.V.R](https://avatars.discourse-cdn.com/v4/letter/x/898d66/32.png) [@XanxusVer.V.R](https://discuss.elastic.co/u/XanxusVer.V.R)\
**Post date:** [December 24, 2018, 5:26pm UTC](https://discuss.elastic.co/t/grok-regular-expression-doesnt-contain-a-word-not-working/162019/1 "2018-12-24T17:26:02Z")

</div>

I have the following log：  
8.8.8.8 - localhost [24/Dec/2018:02:53:15 +0800] "GET **/test/ui/favicons/favicon.ico** HTTP/1.1" 304 0 "[https://www.google.com.tw/](https://www.google.com.tw/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_12\_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"

The current pattern is as follows：  
%{IPORHOST:[nginx][access][remote\_ip]} - %{DATA:[nginx][access][user\_name]} [%{HTTPDATE:[nginx][access][time]}] "%{WORD:[nginx][access][method]} %{MONI\_NOT} HTTP/%{NUMBER:[nginx][access][http\_version]}" %{NUMBER:[nginx][access][response\_code]} %{NUMBER:[nginx][access][body\_sent][bytes]} "%{DATA:[nginx][access][referrer]}" "%{DATA:[nginx][access][agent]}"

MONI\_NOT ^((?!monitor).)\*$

In the grok debugger can not match to...it's not working, as shown below：  
 ![49](https://us1.discourse-cdn.com/elastic/original/3X/d/e/de72afbd2289a1a1c0d1440de080e6979192c221.png)

The other part is removed, it can match：  
 ![54](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2b6d12849b7f05f06f4567ce4ef94f1d4a87282c.png)

I hope that as long as the string that does not contain "monitor" is matched to  
I am sure this regular expression can work：

 ![33](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e0dd90996536d9fd88d8565df0136645c2e57f40.png)

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [December 25, 2018, 6:08am UTC](https://discuss.elastic.co/t/grok-regular-expression-doesnt-contain-a-word-not-working/162019/2 "2018-12-25T06:08:39Z")

</div>

Your `MONI_NOT` pattern starts with the beginning-of-line anchor (`^`), which means that it will never succeed when preceeded by anything other than the beginning of a line.

---

<div class="post-metadata">

**Author:** ![XanxusVer.V.R](https://avatars.discourse-cdn.com/v4/letter/x/898d66/32.png) [@XanxusVer.V.R](https://discuss.elastic.co/u/XanxusVer.V.R)\
**Post date:** [December 25, 2018, 6:35am UTC](https://discuss.elastic.co/t/grok-regular-expression-doesnt-contain-a-word-not-working/162019/3 "2018-12-25T06:35:52Z")

</div>

I would like to ask how can I change `MONI_NOT` pattern ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 22, 2019, 6:36am UTC](https://discuss.elastic.co/t/grok-regular-expression-doesnt-contain-a-word-not-working/162019/4 "2019-01-22T06:36:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.