# Logstash filter: compare time using regex

**URL:** <https://discuss.elastic.co/t/logstash-filter-compare-time-using-regex/89229>\
**Category:** Logstash\
**Created:** [June 13, 2017, 3:34pm UTC](https://discuss.elastic.co/t/logstash-filter-compare-time-using-regex/89229 "2017-06-13T15:34:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![karmax](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@karmax](https://discuss.elastic.co/u/karmax)\
**Post date:** [June 13, 2017, 3:34pm UTC](https://discuss.elastic.co/t/logstash-filter-compare-time-using-regex/89229/1 "2017-06-13T15:34:03Z")

</div>

Hello everybody!  
I use this code in logstash filter to compare time but don't work.

```
if [timecheck] =~ /.*((\[0\]\[0-6\]):\[0-5\]\[0-9\]:\[0-5\]\[0-9\])|((\[1\]\[2-9\]|2\[0-3\]):\[0-5\]\[0-9\]:\[0-5\]\[0-9\]).*/ {
  mutate {
    add_tag => "OVERTIME"
  }
}
else if [timecheck] =~ /.+/ {
  mutate {
    add_tag => "WORKING-HOURS"
  }
}
else {
  mutate { add_tag => "NO-TIMECHECK-MATCH" }
}

```

logstash work but regex not match. Always enter in WORKING-HOURS because timecheck is not empty

(I try regex on [regexr.com](http://regexr.com) and work well)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 13, 2017, 8:13pm UTC](https://discuss.elastic.co/t/logstash-filter-compare-time-using-regex/89229/2 "2017-06-13T20:13:55Z")

</div>

Don't escape the square brackets.

---

<div class="post-metadata">

**Author:** ![karmax](https://avatars.discourse-cdn.com/v4/letter/k/45deac/32.png) [@karmax](https://discuss.elastic.co/u/karmax)\
**Post date:** [June 14, 2017, 7:47am UTC](https://discuss.elastic.co/t/logstash-filter-compare-time-using-regex/89229/3 "2017-06-14T07:47:16Z")

</div>

🙂 thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2017, 7:47am UTC](https://discuss.elastic.co/t/logstash-filter-compare-time-using-regex/89229/4 "2017-07-12T07:47:25Z")

</div>

Closed on July 12, 2017, 7:47am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.