# How to filter events based on certain string? **URL:** \ **Category:** Logstash\ **Created:** [April 8, 2018, 4:35am UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190 "2018-04-08T04:35:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [April 8, 2018, 4:35am UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/1 "2018-04-08T04:35:49Z")
Hi, I am trying to filter out events if it contains either `source_type=\”APP/PROC/WEB\”` or `source_type=APP` in the event. Can someone please help me on this? Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2018, 4:02pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/2 "2018-04-08T16:02:18Z")
If I understand the question correctly then ```auto if [source_type] in ['APP', '"APP/PROC/WEB"'] { drop {} } ``` ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [April 8, 2018, 5:22pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/3 "2018-04-08T17:22:31Z")
Hi, But source\_type is not a field. Basically, I am trying to search for the entire strings `source_type=\”APP/PROC/WEB\”` or `source_type=APP` in [message] field. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2018, 5:54pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/4 "2018-04-08T17:54:34Z")
Thanks for clarifying ```auto if [message] =~ /source_type="APP\/PROC\/WEB"|source_type=APP/ ... ``` ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [April 8, 2018, 6:03pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/5 "2018-04-08T18:03:16Z")
Thanks for the answer. Can you please say if I have to use escape character \ for double quotes and forward slashes. Please let me know if following is correct. ``` if [message] =~ /source_type=\"APP\/PROC\/WEB\"|source_type=APP/{ drop{} } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2018, 7:12pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/6 "2018-04-08T19:12:19Z")
> [@amruth](#): > > Can you please say if I have to use escape character \ for double quotes and forward slashes. Yes for forward slashes, because the right hand side of =~ is a regexp that starts and ends with a forward slash. No for double quotes. If it were a string starting and ending with double quotes rather than a regexp it would be the other way around. ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [April 8, 2018, 7:28pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/7 "2018-04-08T19:28:37Z")
Thanks Badger. It's working perfectly fine with what I have mentioned above. But if I use another if condition, it's not working, ``` if [message] =~ /source_type=\"APP\/PROC\/WEB\"|source_type=APP/{ grok{...} } if [message] =~ /event_type=ContainerMetric/{ grok{...} } else{ drop{} } ``` Please say what I am doing wrong. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 8, 2018, 8:17pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/8 "2018-04-08T20:17:30Z")
Any message that matches the first if will be dropped if it does not match the second if. Is that what you want? Or did you mean to do if - else if - else? You do not say what you mean by "not working". What does the message look like (send it to "output { stdout { codec =\> rubydebug } }" or paste an event from the JSON tab in Kibana. And what do want to have happen? What defines "working"? ---
**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\ **Post date:** [April 9, 2018, 3:29pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/9 "2018-04-09T15:29:03Z")
> [@Badger](#): > > Any message that matches the first if will be dropped if it does not match the second if. Is that what you want? Or did you mean to do if - else if - else? I am looking something like if the event has to be checked with two if conditions else it should be dropped. In my case the moment I remove else statement, I could see events related to 2 conditions in Elasticsearch but when I use else statement, I don't see any messages in Elasticsearch.(Input is from syslog server which continuously flow through udp input plugin ) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 7, 2018, 3:29pm UTC](https://discuss.elastic.co/t/how-to-filter-events-based-on-certain-string/127190/10 "2018-05-07T15:29:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.