Logstash Regex

[pmorenosi (Pablo)]

Hello everybody,

in a logstash pipeline I am doing the following "if"

if [message] = ~ /^postfix.*/anvil$/ {
match => ["message", "% {POSTFIX_ANVIL} $"]
}

LOG

May 11 05:49:37 smtp postfix / anvil [27651]: statistics: max cache size 3 at May 11 05:46:05

May 10 15:49:43 smtp postfix / oqmgr [6409]: 520D924F303: from = jonathanvillal@example.com, size = 13516, nrcpt = 2 (queue active)

but this regular expression matches both lines since the email address matches "anvil", how can I make it match exactly with "postfix/anvil"

Thank you.

[Badger]

If you want to match anvil only when it is a word then include word boundaries in your pattern -- replace anvil with \banvil\b.