# If statement incorrectly matches wildcard

**URL:** <https://discuss.elastic.co/t/if-statement-incorrectly-matches-wildcard/219322>\
**Category:** Logstash\
**Created:** [February 14, 2020, 7:58am UTC](https://discuss.elastic.co/t/if-statement-incorrectly-matches-wildcard/219322 "2020-02-14T07:58:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [February 14, 2020, 7:58am UTC](https://discuss.elastic.co/t/if-statement-incorrectly-matches-wildcard/219322/1 "2020-02-14T07:58:13Z")

</div>

Hi,

I have the following piece of code and noticed that for some reason when the IP is in the `192.168.150.*` range, both dev and test are matched. If the IP is in the `192.168.1.*` range it correctly matches only dev.

If the IP is in the 192.168.0.\* range (and the other IP still in the 150.\* range) the same issue does not occur and int\_lan is only dev or test.

Based on this I'm guessing the wildcard is applied after 192.168.1\* and not after the third octed like I want.

```
  if [src_addr] =~ "192.168.150.*" {
       mutate {
        add_field => { "int_lan" => "test" }
                }
  }

  if [src_addr] =~ "192.168.1.*" {
       mutate {
        add_field => { "int_lan" => "dev" }
                }
  }
```

---

<div class="post-metadata">

**Author:** ![andres-perez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andres-perez/32/136461_2.png) [@andres-perez](https://discuss.elastic.co/u/andres-perez)\
**Post date:** [February 14, 2020, 12:36pm UTC](https://discuss.elastic.co/t/if-statement-incorrectly-matches-wildcard/219322/2 "2020-02-14T12:36:24Z")

</div>

> [@Sjaak01](#):
>
> Based on this I'm guessing the wildcard is applied after 192.168.1\* and not after the third octed like I want.

You are right 🙂

In fact, with `=~` you are not using wildcards but a **regular expression** comparison.

If you don't want to invest more time learning it, these are the minimum hints:

`.` will match exactly 1 character. It's "the wildard" for only 1 character no matter which type (letter, number, symbol, space, etc).  
`\.` If you want to match the exact "point" character, you have to escape it.  
`*` its a quantifier that means "zero or more occurrences" for the preceding element.

A _quick_ way to write your desired conditions would be:

```
if [src_addr] =~ "192\.168\.150\..*" { #only matches "192.168.150." + whatever comes after.
... 
if [src_addr] =~ "192\.168\.1\..*" { #only matches "192.168.1." + whatever comes after.

```

---

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [February 17, 2020, 4:04am UTC](https://discuss.elastic.co/t/if-statement-incorrectly-matches-wildcard/219322/3 "2020-02-17T04:04:53Z")

</div>

Thank you.

I will read up on regular expressions. Your explanation makes things a lot more obvious already.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2020, 4:04am UTC](https://discuss.elastic.co/t/if-statement-incorrectly-matches-wildcard/219322/4 "2020-03-16T04:04:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.