# How to use grok if some pattern is not want to match?

**URL:** https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670
**Category:** Logstash
**Created:** [April 19, 2018, 9:53am UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670 "2018-04-19T09:53:25Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 9:53am UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670/1 "2018-04-19T09:53:26Z")

</div>

I have one input field in which contain boardName and I don’t want to match regex as ".\*tester.\*" . How we can write grok filter to do not match boardname which contain "tester" name.

input json is  
first input  
{  
boardname : "sys-tester-log1",  
logSnippet:" fdsffdsfdsfdsd",  
location : "rack1"  
}  
second input  
{  
boardname : "tcpdump-tester-log1",  
logSnippet:" fdsffdsfdsfdsd",  
location : "rack1"  
}

thirt input json

{  
boardname : "tcpdump-client-log1",  
logSnippet:" fdsffdsfdsfdsd",  
location : "rack1"  
}  
I want grok filter to check boardName and I don’t want to dump json in ES if boardName contains tester name

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 19, 2018, 10:35am UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670/2 "2018-04-19T10:35:28Z")

</div>

Assuming there is more content in the input field and the boardName is separated from the rest of the input by ';', you would match it like this:

`;(?<boardName>(?(?!tester).)+);`

---

<div class="post-metadata">

### Author: ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 10:47am UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670/3 "2018-04-19T10:47:30Z")

</div>

@Jenni post is edited please check.

---

<div class="post-metadata">

### Author: ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 19, 2018, 10:53am UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670/4 "2018-04-19T10:53:37Z")

</div>

Then you don't even need grok, do you?

```
if([boardname] =~ /^.*tester.*$/) {
  drop{}
}
```

---

<div class="post-metadata">

### Author: ![RameshNagargoje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshnagargoje/32/30212_2.png) [@RameshNagargoje](https://discuss.elastic.co/u/RameshNagargoje)
#### Post date: [April 19, 2018, 12:57pm UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670/5 "2018-04-19T12:57:01Z")

</div>

thanks @Jenni it solved my problem

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2018, 12:57pm UTC](https://discuss.elastic.co/t/how-to-use-grok-if-some-pattern-is-not-want-to-match/128670/6 "2018-05-17T12:57:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.