# Logstash if condition regex not working **URL:** \ **Category:** Logstash\ **Created:** [July 27, 2022, 10:15am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737 "2022-07-27T10:15:26Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Gosia96](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@Gosia96](https://discuss.elastic.co/u/Gosia96)\ **Post date:** [July 27, 2022, 10:15am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/1 "2022-07-27T10:15:26Z")
Hi, I'm trying to use regex in the if condition in logstash. My goal is to send the output into 2 different indexes basing on what the field "tags" contains. So far I had no luck with it. Logstash simply ignores my condition and goes to else. I tried even filtering using: if [tags] =~ /.\*/ {} and even this does not work. although I always have some tag in my message. Please help! ![config](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eafb190876ad54fe29ce74f3ccba223ddb58dfc7.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 27, 2022, 11:36am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/2 "2022-07-27T11:36:29Z")
You need to share what your configuration looks like. ---
**Author:** ![Gosia96](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@Gosia96](https://discuss.elastic.co/u/Gosia96)\ **Post date:** [July 27, 2022, 12:17pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/3 "2022-07-27T12:17:07Z")
Hi, I just updated it with my condig. ---
**Author:** ![lzold\_z](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lzold_z/32/108411_2.png) [@lzold\_z](https://discuss.elastic.co/u/lzold_z)\ **Post date:** [July 29, 2022, 3:31am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/4 "2022-07-29T03:31:24Z")
Hi @Gosia96 , could you provide your sample input configuration too ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [July 29, 2022, 6:14am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/5 "2022-07-29T06:14:31Z")
You can use exact word like \_grokparsefailure or just failure `if "_grokparsefailure" in [tags] { code... )` ```auto output { if (("_grokparsefailure" in [tags]) or ("_groktimeout" in [tags]) ) { elasticsearch { ...} } } ``` Also you can use regex for fields: - start with a word failure: `if ([field]=~ /\Afailure/) { ... }` - contain a word failure `if ([field]=~ /\bfailure\b/ { ... }` ---
**Author:** ![Gosia96](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@Gosia96](https://discuss.elastic.co/u/Gosia96)\ **Post date:** [July 31, 2022, 8:28pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/6 "2022-07-31T20:28:51Z")
Hi, This also does not work for me. ![confif](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bff45f33900081d88ce92a62175c8cfc92b9dbd1.png) ![output](https://us1.discourse-cdn.com/elastic/original/3X/2/6/26b2334f8503dd85140ff8f2336af525008e093e.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 31, 2022, 9:00pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/7 "2022-07-31T21:00:22Z")
You cannot use =~ to iterate over an array. I would do it in ruby ``` ruby { code => ' tags = event.get("tags") if ! tags ; tags = [] ; end event.set("failed", tags.any? { |x| x =~ /failure\b/ }) ' } ``` ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [August 1, 2022, 3:12am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/8 "2022-08-01T03:12:37Z")
Use this: `if ("_checkpoint_grok_failure" in [tags]) { .. }` ---
**Author:** ![Gosia96](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@Gosia96](https://discuss.elastic.co/u/Gosia96)\ **Post date:** [August 1, 2022, 6:36am UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/9 "2022-08-01T06:36:55Z")
=~ does not work for me even if there is no array - the 2 other tags were only my test-tags. After I removed it, it still does not work. Could u elaborate how I could use your ruby code to get my result? I need to sent the message into different index if my tag contains the word "failure" and I never used ruby in my life. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2022, 1:01pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/10 "2022-08-01T13:01:45Z")
That could be because your regexp is wrong. \_grokparsefailure does not have a \b before failure. If you add the ruby filter to your configuration then you could also add ``` if [failed] { mutate { add_tag = ["DO NOT WORKS"] } } else { mutate { add_tag = ["Works"] } } ``` ---
**Author:** ![Gosia96](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@Gosia96](https://discuss.elastic.co/u/Gosia96)\ **Post date:** [August 1, 2022, 1:56pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/11 "2022-08-01T13:56:53Z")
Thank you for your help, this worked! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2022, 1:57pm UTC](https://discuss.elastic.co/t/logstash-if-condition-regex-not-working/310737/12 "2022-08-29T13:57:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.