# How use multiple if regex expression in output segment
**URL:** https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991
**Category:** Logstash
**Created:** [May 8, 2018, 11:48am UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991 "2018-05-08T11:48:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@adg](https://discuss.elastic.co/u/adg)
#### Post date: [May 8, 2018, 11:48am UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/1 "2018-05-08T11:48:30Z")
input
> input {
> beats {
> port =\> 5044
> }
> }
Filter
> csv{
> separator =\> ","
> columns =\> ["DateTime" ,"hname" ,"uname" ,"cwd","fname","line"]
> }
Output
> if [line] in ["Delhi" , "Mumbai", "Chennai", "Kolkata" , "Hydrabad" ,"Pune"]{
> email{
>
> }
> }
the problem i m facing is that the **line** tag may contain this
1. Delhi OR Mumbai OR Chennai
or contain
2. Delhi OR Mumbai
if first case found it trigger mail
in second case it do nothing
please help me i stuck here from very long time
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 8, 2018, 12:08pm UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/2 "2018-05-08T12:08:23Z")
Please show
- an example line of input for both cases so there won't be any misunderstandings, and
- an example event produced by Logstash (use a `stdout { codec => rubydebug }` output).
---
### Author:  [@adg](https://discuss.elastic.co/u/adg)
#### Post date: [May 8, 2018, 12:47pm UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/3 "2018-05-08T12:47:36Z")
my input lines form file is this
> 2018-04-17T18:40:17+0530,ip-10-0-1-14,root,loyal,quotes.txt,Delhi
> 2018-04-17T18:40:17+0530,ip-10-0-1-14,root,honest,quotes.txt,Delhi 06
> 2018-04-17T18:40:17+0530,ip-10-0-1-14,root,satisfied,quotes.txt,Delhi 53
> 2018-04-17T18:40:17+0530,ip-10-0-1-14,root,confident,quotes.txt,Mumbai 02
> 2018-04-17T18:40:17+0530,ip-10-0-1-14,root,success,quotes.txt,Mumbai
my out put is in
stdout { codec =\> rubydebug }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "confident",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.956Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,confident,quotes.txt,Mumbai 02",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Mumbai 02"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "satisfied",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.955Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,satisfied,quotes.txt,Delhi 53",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Delhi 53"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "confident",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.956Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,confident,quotes.txt,Mumbai 02",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Mumbai 02"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "satisfied",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.955Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,satisfied,quotes.txt,Delhi 53",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Delhi 53"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "loyal",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.945Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,loyal,quotes.txt,Delhi",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Delhi"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "honest",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.955Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,honest,quotes.txt,Delhi 06",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Delhi 06"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "success",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.956Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,success,quotes.txt,Mumbai",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Mumbai"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "loyal",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.945Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,loyal,quotes.txt,Delhi",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Delhi"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "honest",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.955Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,honest,quotes.txt,Delhi 06",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Delhi 06"
> }
> {
> "fname" =\> "quotes.txt",
> "uname" =\> "root",
> "cwd" =\> "success",
> "hname" =\> "ip-10-0-1-14",
> "DateTime" =\> "2018-04-17T18:40:17+0530",
> "@timestamp" =\> 2018-05-08T12:42:45.956Z,
> "@version" =\> "1",
> "host" =\> "Latitude-3460",
> "message" =\> "2018-04-17T18:40:17+0530,ip-10-0-1-14,root,success,quotes.txt,Mumbai",
> "path" =\> "/home/root3460/input1",
> "line" =\> "Mumbai"
> }
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 8, 2018, 1:34pm UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/4 "2018-05-08T13:34:27Z")
Okay, and where are the "Delhi OR Mumbai" entries you had issues with?
---
### Author:  [@adg](https://discuss.elastic.co/u/adg)
#### Post date: [May 8, 2018, 1:52pm UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/5 "2018-05-08T13:52:42Z")
**Delhi OR Mumbai** is not coming together
issue is when **Delhi** comes with some number or character like
**Delhi 06** or **Delhi 53** or **Mumbai 02**
mention in above input line
it is consider as FALSE
mean not going for email
but if only **Delhi** or **Mumbai** comes alone then mail trigger
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 8, 2018, 7:28pm UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/6 "2018-05-08T19:28:16Z")
> Delhi OR Mumbai is not coming together
> issue is when Delhi comes with some number or character like
> Delhi 06 or Delhi 53 or Mumbai 02
> mention in above input line
Okay. Then I understand what you mean, but your first post still doesn't make any sense.
> it is consider as FALSE
> mean not going for email
> but if only Delhi or Mumbai comes alone then mail trigger
You can e.g. use a mutate filter's gsub option to delete the trailing digits from the field and use that field in your comparison. If you don't want to touch the original field you can first copy the `line` field into a temporary field and remove the digits from there.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 5, 2018, 7:33pm UTC](https://discuss.elastic.co/t/how-use-multiple-if-regex-expression-in-output-segment/130991/7 "2018-06-05T19:33:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.