How to use grok if some pattern is not want to match?

I have one input field in which contain boardName and I don’t want to match regex as ".*tester.*" . How we can write grok filter to do not match boardname which contain "tester" name.

input json is
first input
{
boardname : "sys-tester-log1",
logSnippet:" fdsffdsfdsfdsd",
location : "rack1"
}
second input
{
boardname : "tcpdump-tester-log1",
logSnippet:" fdsffdsfdsfdsd",
location : "rack1"
}

thirt input json

{
boardname : "tcpdump-client-log1",
logSnippet:" fdsffdsfdsfdsd",
location : "rack1"
}
I want grok filter to check boardName and I don’t want to dump json in ES if boardName contains tester name

Assuming there is more content in the input field and the boardName is separated from the rest of the input by ';', you would match it like this:

;(?<boardName>(?(?!tester).)+);

@Jenni post is edited please check.

Then you don't even need grok, do you?

if([boardname] =~ /^.*tester.*$/) {
  drop{}
}

thanks @Jenni it solved my problem

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.