# Logstash pattern not working

**URL:** <https://discuss.elastic.co/t/logstash-pattern-not-working/38479>\
**Category:** Logstash\
**Created:** [January 6, 2016, 8:43am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working/38479 "2016-01-06T08:43:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nivetha](https://avatars.discourse-cdn.com/v4/letter/n/54ee81/32.png) [@nivetha](https://discuss.elastic.co/u/nivetha)\
**Post date:** [January 6, 2016, 8:43am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working/38479/1 "2016-01-06T08:43:20Z")

</div>

I have to match all m3u8 content as hls and others as pdl, but only the else part is working (displaying pdl)  
Below is my code  
filter{  
if[Content] == "\*.m3u8"  
{  
mutate {  
add\_field =\> ["TrafficType", "hls"]  
}  
}  
else  
{  
mutate {  
add\_field =\> ["TrafficType", "pdl"]  
}  
}  
}  
Any other way to make this.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 6, 2016, 11:37am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working/38479/2 "2016-01-06T11:37:51Z")

</div>

You're a bit short on details, but it seems you're trying to use wildcards with the equality operator (`==`) but it doesn't support that. You need to use regexp matches.

```auto
filter {
  if [Content] =~ /\.m3u8$/ {
    ...
  } else {
    ...
  }
}

```

I'm not sure my example uses a correct regexp since I don't know what your `Content` field contains, but you should get the idea.

---

<div class="post-metadata">

**Author:** ![nivetha](https://avatars.discourse-cdn.com/v4/letter/n/54ee81/32.png) [@nivetha](https://discuss.elastic.co/u/nivetha)\
**Post date:** [January 7, 2016, 5:33am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working/38479/3 "2016-01-07T05:33:21Z")

</div>

thanks magnusbaeck . working fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working/38479/4 "2017-07-06T05:16:35Z")

</div>