# IF Statement With RegEx

**URL:** <https://discuss.elastic.co/t/if-statement-with-regex/173538>\
**Category:** Logstash\
**Created:** [March 22, 2019, 5:28pm UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538 "2019-03-22T17:28:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [March 22, 2019, 5:28pm UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538/1 "2019-03-22T17:28:28Z")

</div>

Hi,

I'm using an IF statement with RegEx but it's never true and seems to skip the whole IF statement.

It doesn't get a far as "[message] =~ /(\QChanges\E)/" so I assume that probably doesn't work either as the first condition isn't met or wrong.

The part that isn't working is in Bold.

Please advise.

Thanks

Martin

example:  
message string: "some text **FIM** more text"

filter {  
if [type] == "acsc-main-alerts" {  
mutate {  
convert =\> { "eventtime" =\> "string" }  
}  
date {  
match =\> ["eventtime", "ISO8601"]  
remove\_field =\> ["eventtime"]  
}  
**if [message] =~ /\QFIM\E/ {**  
mutate {  
add\_field =\> { "severity" =\> "%{criticality}" }  
}  
if [message] =~ /(\QChanges\E)/ {  
mutate {  
add\_field =\> { "acsctype" =\> "FIM Change" }  
}  
} else if [message] =~ /(\QErrors\E)/ {  
mutate {  
add\_field =\> { "acsctype" =\> "FIM Error" }  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 22, 2019, 8:42pm UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538/2 "2019-03-22T20:42:21Z")

</div>

\Q and \E are a feature of Java regexps. I do not believe Ruby regexps implement them, so it will expect the match them in the string. Why do you need them for a string like FIM?

---

<div class="post-metadata">

**Author:** ![martb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martb/32/78185_2.png) [@martb](https://discuss.elastic.co/u/martb)\
**Post date:** [March 26, 2019, 9:41am UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538/3 "2019-03-26T09:41:29Z")

</div>

> [@martb](#):
>
> "some text **FIM** more text"

Thanks for the reply.  
I'm trying to match if the word FIM exist anywhere within the string i.e "some text **FIM** more text".

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 26, 2019, 1:02pm UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538/4 "2019-03-26T13:02:46Z")

</div>

In that case \Q and \E are inappropriate. Just use

```
if [message] =~ /FIM/ ...
```

---

<div class="post-metadata">

**Author:** ![Rondy24](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Rondy24](https://discuss.elastic.co/u/Rondy24)\
**Post date:** [April 20, 2019, 7:16am UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538/5 "2019-04-20T07:16:57Z")

</div>

Mate,u cant use \Q and \E with this system.It is all valid till Java regexps...U cant expect it to run in every software..SO avoid using this as it is not gonna work..U can also find command guidelines from [official site](https://www.myccpay.net/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2019, 7:17am UTC](https://discuss.elastic.co/t/if-statement-with-regex/173538/6 "2019-05-18T07:17:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.