Inclusion and regex on conditionals

This will match the exact match of "SCD" or will also match "scd" or "SCD-abc"? works like a linux grep?

        if [hostgroup] =~ /SCD/ { mutate { add_field => { "indexname" => "scd" }}}

What is the diference with:

        if [SCD]  in  [hostgroup] { mutate { add_field => { "indexname" => "scd" }}}

again, this will match "scd" or "SCD-abc"?


If I were you, I'd check an online regex tester and maybe read some articles about it.

Java uses a Perl-like regex engine, so for basic functionality like yours, any PCRE tester should work.

grep -P uses PCRE too, so you can test with that (or with Logstash too :slight_smile: )

As for the in expression, to quote the documentation:

You can use the in operator to test whether a field contains a specific string, key, or (for lists) element.

To answer your specific question wrt the specific regex:
/SCD/ won't match scd, but should match the SCD in SCD-abc.

1 Like

logstash uses ruby regexps.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.