# Issue with regular expression

**URL:** <https://discuss.elastic.co/t/issue-with-regular-expression/365313>\
**Category:** Logstash\
**Created:** [August 21, 2024, 9:29pm UTC](https://discuss.elastic.co/t/issue-with-regular-expression/365313 "2024-08-21T21:29:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![UMUT\_CAN\_ARGUN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umut_can_argun/32/136553_2.png) [@UMUT\_CAN\_ARGUN](https://discuss.elastic.co/u/UMUT_CAN_ARGUN)\
**Post date:** [August 21, 2024, 9:29pm UTC](https://discuss.elastic.co/t/issue-with-regular-expression/365313/1 "2024-08-21T21:29:58Z")

</div>

My regex for the sample log line looks line this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef3079ba4dfe665cc0481f728bb9bb914a642cce.png)  
As you see, the endpoint section doesn’t match for “usr/admin/developer” although what I write in my regex. What is my mistake?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 21, 2024, 9:41pm UTC](https://discuss.elastic.co/t/issue-with-regular-expression/365313/2 "2024-08-21T21:41:00Z")

</div>

> [@UMUT\_CAN\_ARGUN](#):
>
> As you see, the endpoint section doesn’t match for “usr/admin/developer” although what I write in my regex. What is my mistake?

You have an alternation of three patterns, followed by .\*

The second of the three matched. There is nothing telling the regexp engine that it should prefer the longer third possible match.

If the endpoint is always followed by a space then why not precede the .\* with a space to anchor the end of the endpoint pattern?

Another option might be /usr(/[a-z]+)? but I am not sure if that wants to be greedy.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [August 22, 2024, 5:37am UTC](https://discuss.elastic.co/t/issue-with-regular-expression/365313/3 "2024-08-22T05:37:30Z")

</div>

Why don't you use the grok notation like [HTTPD\_COMMONLOG](https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/httpd)? Not just pure regex.