Hard regex

Elastic Stack Logstash
1

hi, i need your help to write regex. It's my e.g message:
scc_check_file ignored non-ASCII file /etc/sysconfig/auditd: '/etc/sysconfig/auditd: regular file, no read permission'

I want to write if, which checks in part for : (scc_check_file ignored non-ASCII file /etc/sysconfig/auditd) there are no such characters as: \ , / , * , ? , " , < , > , | , space (the character, not the word), , , #

2

I dont understand what you're trying to do,

can you explain with details ?

also check for grok debugger and https://regex101.com/

3

value= "scc_check_file ignored non-ASCII file /etc/sysconfig/auditd: '/etc/sysconfig/auditd: regular file, no read permission'"

if [value] (to the mark :slight_smile: =~ /contains \ , / , * , ? , " , < , > , | , space (the character, not the word), , , #/ {
drop {}
}

but value up to the character :

4

What about extracting the interesting part first, like:

  grok {
    match => { "message" => "%{DATA:partial_value}:" }
  }

  if [partial_value] =~ /[\\\/\*\?\"\<\>\|\s\,\#]/ {
    drop{}
  }

Obviously you can replace message with value if you've already extracted the value field.

5

Sounds good to me.