# How to do a conditional regex on or?

**URL:** <https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172>\
**Category:** Logstash\
**Created:** [April 15, 2020, 4:52pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172 "2020-04-15T16:52:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\
**Post date:** [April 15, 2020, 4:52pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172/1 "2020-04-15T16:52:14Z")

</div>

i have three files named:

```
- foo.log.2020-02-17.log

- bar.log

- foo.log.17-02-2020

```

i need to extract the whole file name and the date aswell i tried this expression but it's not working for me:

```auto
(?< app_name >.*(?< logdate >({YEAR}-%{MONTHNUM}-%{MONTHDAY})|(%{MONTHDAY}-%{MONTHNUM}-%{YEAR}))?(.log)?)`

```

when i remove the "?" after %{YEAR})) it works fine with files containing date

i spent 2 hours trying to figure it out, if someone could help i'll be so much grateful.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2020, 5:56pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172/2 "2020-04-15T17:56:05Z")

</div>

> [@Amine\_Maalfi](#):
>
> ))?

I think that should be )?)

---

<div class="post-metadata">

**Author:** ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\
**Post date:** [April 15, 2020, 6:24pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172/3 "2020-04-15T18:24:57Z")

</div>

it didn't work, it gives the following output:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40fb1dba57df0ff273fae9ac41f32ce909a44c93.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 15, 2020, 9:13pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172/4 "2020-04-15T21:13:39Z")

</div>

That's a reasonable way for it to match. The .\* in ' app\_name ' consumes everything and all parts of ' logdate ' are optional, so an empty string matches. In a grok filter you can match against an array of patterns, one of which has an optional .log and the other has an optional date.

---

<div class="post-metadata">

**Author:** ![Amine\_Maalfi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amine_maalfi/32/62335_2.png) [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\
**Post date:** [April 15, 2020, 9:57pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172/5 "2020-04-15T21:57:48Z")

</div>

> [@Amine\_Maalfi](#):
>
> ))?

I think that should be )?)

your last reply solved my problem but, the ))? worked better because if the string doesn't exist the tag isn't shown at all and that's exactly what i need. with )?) it shows logdate:"" when there's no date.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2020, 9:57pm UTC](https://discuss.elastic.co/t/how-to-do-a-conditional-regex-on-or/228172/6 "2020-05-13T21:57:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.