# Is positive lookbehind supported in Logstash at all?

**URL:** <https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388>\
**Category:** Logstash\
**Created:** [March 16, 2021, 2:32pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388 "2021-03-16T14:32:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [March 16, 2021, 2:32pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388/1 "2021-03-16T14:32:43Z")

</div>

Hi there all, i started with Logstash the other day and currently getting to know the tool.  
I have a situation here.

Consider the below Baraccuda FW log entry

```auto
2018 01 30 13:12:21 Security +01:00 Block: type=FWD|proto=UDP|srcIF=eth0|srcIP=10.17.34.12|srcPort=54915|srcMAC=18:db:f2:13:ca:9c|dstIP=10.17.34.255|dstPort=54915|dstService=|dstIF=|rule=BLOCKALL|info=Block by Rule|srcNAT=0.0.0.0|dstNAT=0.0.0.0|duration=0|count=1|receivedBytes=0|sentBytes=0|receivedPackets=0|sentPackets=0|user=|protocol=|application=|target=|content=|urlcat=`

```

I use [Grok Debugger](https://grokdebug.herokuapp.com/) for testing

My grok regex so far is as follows

```auto
 %{YEAR} %{MONTHNUM} %{MONTHDAY} %{TIME} %{WORD:type_of_log} (?<tz>\+\d+:\d+) (?<action>\w+(?=\:\s))(?<tbd>\S) (?<type>(?<=w+=)\\w+\|)

```

What i want is to capture **FWD** string only when it's after **type=**.  
In essence capturing "type=FWD" but only displaying FWD from the log entry above.  
However this did not work for me although I tested this on [regex101.com](http://regex101.com) and it worked there.  
 ![12](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43746c615a8adcb5a7069e592cef951d06d5d49f.png)

My positive lookahead worked as charm though matching Block: but only displaying Block without the semicolon : and the space - (**?\w+(?=:\s)**

Could you please help me!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 16, 2021, 4:16pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388/2 "2021-03-16T16:16:49Z")

</div>

Personally I would approach a log like this using

```
    dissect { mapping => { "message" => "%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{word1} %{word2} %{word3} %{[@metadata][restOfLine]}" } }
    date { match => ["[@metadata][ts]", "YYYY MM dd HH:mm:ss" ] }
    kv { field_split => "|" value_split => "=" }

```

That said, to answer the question: yes, positive lookbehind is supported

```
grok { match => { "message" => "(?<=type=)(?<foo>\w+)" } }

```

will result in

```
       "foo" => "FWD",
```

---

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [March 17, 2021, 6:51am UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388/3 "2021-03-17T06:51:19Z")

</div>

Much appreciated Badger. I'll need some time to read about dissect and comprehend it but really thank you very much.

Otherwise, I also thought that positive lookbehind is supported.  
However, when using the Online grok Debugger, it seems that it did not work.  
Does that mean that the problem might be in the online debugger itself?

As a proof, please, check the below images.  
First picture shows that the grok pattern works so far and it yields results.

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6196d1f0029cf8a4c56b27dd8e35d62400a9973.png)

However, the second (and third) picture shows a valid positive lookbehind  
Firstly, I only typed the field name (second pic) and it worked as my field name is TYPE and this is reflected in the output below (third pic)

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6196d1f0029cf8a4c56b27dd8e35d62400a9973.png)  
 ![3](https://us1.discourse-cdn.com/elastic/original/3X/d/6/d6c3ee189f5ddaf5298e31bec87aad9a5ca5f07f.png)

However, if I try to apply a positive lookbehind it doesnt work as you can see below

 ![4](https://us1.discourse-cdn.com/elastic/original/3X/5/5/55e52eaaa265888b4ce2ba1a163229b3be0b8963.png)  
However, I figure this out 🙂 - A + quantifier inside a lookbehind makes it non-fixed width hence the Compile error

Then I used character class and it works on Regex101  
 ![5](https://us1.discourse-cdn.com/elastic/original/3X/5/1/51e2abd42fab070b5f1afa3b91f29471a39bab55.png)

And again in the online grok debugger didn't work but this time no errors just tells me that there are no matches?

I fully agree with you that your method is much better but nevertheless wanted to iron this out as it really bugs me 🙂

 ![6](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f448ee7dde04acc3fd9dfb4f0ca84b67f7265552.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 17, 2021, 3:38pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388/4 "2021-03-17T15:38:34Z")

</div>

> [@stillfreem](#):
>
> Does that mean that the problem might be in the online debugger itself?

I never use anything other than grok to develop grok patterns because the online grok debugger and even kibana can interpret patterns differently to grok. See [here](https://discuss.elastic.co/t/grokparse-failure-and-after-successful-debug/254324/2) for more detail.

---

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [March 17, 2021, 5:39pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388/5 "2021-03-17T17:39:54Z")

</div>

Your awesome @Badger  
Many thanks.  
Stay safe 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 14, 2021, 5:40pm UTC](https://discuss.elastic.co/t/is-positive-lookbehind-supported-in-logstash-at-all/267388/6 "2021-04-14T17:40:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.