# How to make make an if condition with a regular expression pattern
**URL:** https://discuss.elastic.co/t/how-to-make-make-an-if-condition-with-a-regular-expression-pattern/78338
**Category:** Logstash
**Created:** [March 13, 2017, 12:42pm UTC](https://discuss.elastic.co/t/how-to-make-make-an-if-condition-with-a-regular-expression-pattern/78338 "2017-03-13T12:42:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@DannyM](https://discuss.elastic.co/u/DannyM)
#### Post date: [March 13, 2017, 12:42pm UTC](https://discuss.elastic.co/t/how-to-make-make-an-if-condition-with-a-regular-expression-pattern/78338/1 "2017-03-13T12:42:47Z")
Hi,
i'm new to ELK and trying to filter some spam lines from being added to the elasticsearch server.
to do this i made the following logstash filter:
```
## var_log_messages filter
filter {
if [type] == "var_log_messages" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:var_log_secure_timestamp} %{SYSLOGHOST:var_log_secure_hostname} %{DATA:syslog_program}(?:\[%{POSINT:var_log_secure_pid}\])?: %{GREEDYDATA:message}" }
overwrite => ["message"]
}
##ignore spam line
if ([message] =~ "Got message type[=]signal sender[=](\:1\.0|org\.freedesktop\.DBus) destination[=]n\/a object[=][/]org[/]freedesktop[/]"){
drop{}
}
else if ([message] =~ "GSSAPI client step ([0-9]{1,2})"){
drop{}
}
}
}
```
I want to make the rules more universal so i drops more unwantend log lines like:
so i made the following line but is does not catch all the unwanted lines:
Sent message type=method\_call sender=n/a destination=org.freedesktop.systemd1 object=/org/freedesktop/systemd1/unit/session\_2d528\_2escope interface=org.freedesktop.DBus.Properties member=Get cookie=9163 reply\_cookie=0 error=n/a
Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=SessionNew cookie=9131 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/httpd\_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=121996 reply\_cookie=0 error=n/a
Got message type=signal sender=org.freedesktop.DBus destination=n/a object=/org/freedesktop/DBus interface=org.freedesktop.DBus member=NameOwnerChanged cookie=2019 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/user\_2d0\_2eslice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=180590 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=UnitRemoved cookie=180633 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/dev\_2dmapper\_2dsystemvg\_5cx2dtmp\_2edevice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=180638 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/dev\_2dmapper\_2dsystemvg\_5cx2dvar\_2edevice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=180647 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=UnitRemoved cookie=180622 reply\_cookie=0 error=n/a
Got message type=signal sender=:1.0 destination=n/a object=/org/freedesktop/systemd1/unit/dev\_2dmapper\_2dsystemvg\_5cx2dvar\_5flog\_5faudit\_2edevice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=180565 reply\_cookie=0 error=n/a
Sent message type=method\_call sender=n/a destination=org.freedesktop.DBus object=/org/freedesktop/DBus interface=org.freedesktop.DBus member=GetConnectionUnixUser cookie=5007 reply\_cookie=0 error=n/a
`(Got|Sent) message type[=](method\_return|method\_call|signal) (sender)\=(n\/a|\:1\.0|org\.freedesktop\.*?([a-zA_Z])) [destination]`
the `*?([a-zA_Z])) [destination]` part is because i'm trying some things
When i test the lines it does not match all of them [https://grokconstructor.appspot.com/do/match#result](https://grokconstructor.appspot.com/do/match#result)
because within a if condition you can't use a grok patter i'm using regular expression.
my question how can I make an regular expression to match parts of the line ignore som chars en again match chars and ignore some chars.
like:
`Sent message type=method_call sender=n/a destination=org.freedesktop> .(ignore some chars here )object=/org/freedesktop/> ignore some chars interface=org.freedesktop.DBus.Properties member=Get cookie=9163 reply_cookie=0 error=n/a`
---
### Author:  [@DannyM](https://discuss.elastic.co/u/DannyM)
#### Post date: [March 13, 2017, 2:17pm UTC](https://discuss.elastic.co/t/how-to-make-make-an-if-condition-with-a-regular-expression-pattern/78338/2 "2017-03-13T14:17:45Z")
i've made my own solution:
by using allowing the following chars 1 or more times `[a-zA-Z0-9]+` and `[a-zA-Z0-9\/\_]+`
the things left we will ignore: `member=Get cookie= reply_cookie=0 error=n/a`
`(Got|Sent) message type[=](method\_return|method\_call|signal) (sender)\=(n\/a|\:1\.0|org\.freedesktop\.[a-zA-Z0-9]+) destination[=](n\/a|\:1\.0|org\.freedesktop\.[a-zA-Z0-9]+) object\=\/org\/freedesktop\/[a-zA-Z0-9\/\_]+ interface\=org\.freedesktop\.[a-zA-Z0-9]+`
When testing all rules are matched! 😀
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 10, 2017, 2:18pm UTC](https://discuss.elastic.co/t/how-to-make-make-an-if-condition-with-a-regular-expression-pattern/78338/3 "2017-04-10T14:18:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.