# If condition regex error **URL:** \ **Category:** Logstash\ **Created:** [January 13, 2021, 6:41am UTC](https://discuss.elastic.co/t/if-condition-regex-error/260939 "2021-01-13T06:41:37Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![nyquillus](https://avatars.discourse-cdn.com/v4/letter/n/c77e96/32.png) [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Post date:** [January 13, 2021, 6:41am UTC](https://discuss.elastic.co/t/if-condition-regex-error/260939/1 "2021-01-13T06:41:37Z")
Hi, I created a working logstash.conf with if/else conditions. Now I'm trying to implement regex to make the filters less messy. The current filter is like this: ``` filter { if [tag] == /^[a|b|c]*$/ { mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+YYYY.MM.dd}" } } } else if [tag] == /^[d|e|f]*$/ { mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+YYYY.MM}" } } } else if [tag] == /^[abc|def]*$/ { mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+xxxx.ww}" } } } else { mutate { add_field => { "[@metadata][target_index]" => "%{tag}-%{+YYYY}" } } } } ``` But got this error while creating logstash container: `[2021-01-13T06:26:04,851][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"Java::JavaLang::IllegalArgumentException", :message=>"Failed to parse right-hand side of conditional [file]/usr/share/logstash/pipeline/logstash.conf:8:12:```\n[tag] == /^[a|b|c]*$/\n```", :backtrace=>["org.logstash.config.ir.expression.BinaryBooleanExpression.ensureNotNull(org/logstash/config/ir/expression/BinaryBooleanExpression.java:74)", "org.logstash.config.ir.expression.BinaryBooleanExpression.(org/logstash/config/ir/expression/BinaryBooleanExpression.java:54)", "org.logstash.config.ir.expression.binary.Eq.(org/logstash/config/ir/expression/binary/Eq.java:29)", "org.logstash.config.ir.DSL.eEq(org/logstash/config/ir/DSL.java:133)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)", "jdk.internal.reflect.NativeMethodAccessorImpl.invoke(jdk/internal/reflect/NativeMethodAccessorImpl.java:62)", "jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(jdk/internal/reflect/DelegatingMethodAccessorImpl.java:43)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:566)", "org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(org/jruby/javasupport/JavaMethod.java:426)", "org.jruby.javasupport.JavaMethod.invokeStaticDirect(org/jruby/javasupport/JavaMethod.java:358)", "org.jruby.RubyMethod.call(org/jruby/RubyMethod.java:131)", "org.jruby.RubyMethod$INVOKER$i$call.call(org/jruby/RubyMethod$INVOKER$i$call.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:457)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:432)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.join_conditions(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:379)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.join_conditions(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:378)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$join_conditions$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:327)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr_cond(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:296)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr_cond$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:242)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:239)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "org.jruby.RubySymbol$SymbolProcBody.yieldInner(org/jruby/RubySymbol.java:1440)", "org.jruby.RubySymbol$SymbolProcBody.doYield(org/jruby/RubySymbol.java:1456)", "org.jruby.RubyArray.collect(org/jruby/RubyArray.java:2563)", "org.jruby.RubyArray.map(org/jruby/RubyArray.java:2577)", "org.jruby.RubyArray$INVOKER$i$0$0$map19.call(org/jruby/RubyArray$INVOKER$i$0$0$map19.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.expr(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:85)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.RUBY$method$expr$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/compiler//usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.compile(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:64)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1809)", "org.jruby.RubyArray$INVOKER$i$0$0$each.call(org/jruby/RubyArray$INVOKER$i$0$0$each.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.lscl.compile(/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:62)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_imperative(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:62)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.RUBY$method$compile_imperative$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/compiler.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_graph(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.RUBY$method$compile_graph$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/compiler.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_sources(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28)", "org.jruby.RubyArray.collect(org/jruby/RubyArray.java:2563)", "org.jruby.RubyArray.map(org/jruby/RubyArray.java:2577)", "org.jruby.RubyArray$INVOKER$i$0$0$map19.call(org/jruby/RubyArray$INVOKER$i$0$0$map19.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.compile_sources(/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27)", "usr.share.logstash.logstash_minus_core.lib.logstash.compiler.RUBY$method$compile_sources$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash//usr/share/logstash/logstash-core/lib/logstash/compiler.rb)", "org.jruby.RubyClass.finvoke(org/jruby/RubyClass.java:812)", "org.jruby.RubyBasicObject.callMethod(org/jruby/RubyBasicObject.java:372)", "org.logstash.config.ir.ConfigCompiler.configToPipelineIR(org/logstash/config/ir/ConfigCompiler.java:53)", "org.logstash.execution.AbstractPipelineExt.initialize(org/logstash/execution/AbstractPipelineExt.java:181)", "org.logstash.execution.JavaBasePipelineExt.initialize(org/logstash/execution/JavaBasePipelineExt.java:67)", "org.logstash.execution.JavaBasePipelineExt$INVOKER$i$1$0$initialize.call(org/logstash/execution/JavaBasePipelineExt$INVOKER$i$1$0$initialize.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.initialize(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43)", "org.jruby.RubyClass.newInstance(org/jruby/RubyClass.java:939)", "org.jruby.RubyClass$INVOKER$i$newInstance.call(org/jruby/RubyClass$INVOKER$i$newInstance.gen)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.execute(/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52)", "usr.share.logstash.logstash_minus_core.lib.logstash.pipeline_action.create.RUBY$method$execute$0$ __VARARGS__ (usr/share/logstash/logstash_minus_core/lib/logstash/pipeline_action//usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb)", "usr.share.logstash.logstash_minus_core.lib.logstash.agent.converge_state(/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342)", "org.jruby.RubyProc.call(org/jruby/RubyProc.java:318)", "java.lang.Thread.run(java/lang/Thread.java:834)"]}` What am i missing? Thanks. ---
**Author:** ![nyquillus](https://avatars.discourse-cdn.com/v4/letter/n/c77e96/32.png) [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Post date:** [January 13, 2021, 7:29am UTC](https://discuss.elastic.co/t/if-condition-regex-error/260939/2 "2021-01-13T07:29:02Z")
Ok i found the problem. I used `"=="` between key and value it should be `"=~"` now it works. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 10, 2021, 7:29am UTC](https://discuss.elastic.co/t/if-condition-regex-error/260939/3 "2021-02-10T07:29:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.