# Issue with regex pattern for prune filter plugin blacklist\_names

**URL:** <https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834>\
**Category:** Logstash\
**Created:** [July 23, 2019, 2:14pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834 "2019-07-23T14:14:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sai\_kiran1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_kiran1/32/44118_2.png) [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\
**Post date:** [July 23, 2019, 2:14pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834/1 "2019-07-23T14:14:32Z")

</div>

Hi There!

I am trying to ignore the fields a4, a5, a6....., a1100 from my audit logs and tried applying prune filter plugin with setting blacklist\_names, but I see the fields a4, a5, a6..... are still incoming.

Can someone let me know if this is the correct way we use regex for prune Or suggest any way to achieve this particular scenario where I can ignore a specific set of fields?

Below is the setting that was implemented:

prune {  
blacklist\_names =\> ["^a[4-9][0-9][0-9][0-9]"]  
add\_tag =\> ["pruned"]  
}

Thanks,  
Sai

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 23, 2019, 2:22pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834/2 "2019-07-23T14:22:28Z")

</div>

No, it does not work that way. See [this](https://discuss.elastic.co/t/using-prune-filter-to-remove-null-value-fields/191659/2) post.

---

<div class="post-metadata">

**Author:** ![sai\_kiran1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_kiran1/32/44118_2.png) [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\
**Post date:** [July 23, 2019, 3:38pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834/3 "2019-07-23T15:38:09Z")

</div>

@Badger Thanks for the reference , Does this work with field names as well ?  
I need to check on field names and ignore if it falls in the list of field names

In my case field names are a4, a5, a6, a7.......a2000.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 23, 2019, 3:54pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834/4 "2019-07-23T15:54:08Z")

</div>

Yes, in that example I am testing the value

```
                if v == ""
                    event.remove(k)
                end

```

But you could equally well test the key against whatever regexp you want

```
  if k =~ /^a[0-9]+/ ...
```

---

<div class="post-metadata">

**Author:** ![sai\_kiran1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_kiran1/32/44118_2.png) [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\
**Post date:** [July 25, 2019, 4:07pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834/5 "2019-07-25T16:07:30Z")

</div>

@Badger that helped me to achieve my requirement, Thank you.

Below is the code I used to ignore fields a4, a5, a6, a7.......a2000 keeping a0, a1, a2, a3

```
ruby {
                        code => "event.to_hash.each { |k, v|
                                        if k =~ /^a[4-9]/ || k=~ /^a[0-9]{2,}/
                                                event.remove(k)
                                                event.tag('ruby')
                                        end
                                        }
                                "
                }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2019, 4:07pm UTC](https://discuss.elastic.co/t/issue-with-regex-pattern-for-prune-filter-plugin-blacklist-names/191834/6 "2019-08-22T16:07:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.