Logstash regexp if not working

[rpuserh (Ruben Papovyan)]

hi,
I have JSON which has key body.message and content of this key can be JSON[OBJECT] or text (I cant insert like this to ES as it giving mapping error)
I want to move it to another field if it look like text and exists
But this config is not working (Now it matching everything)
Please help me,

Thanks in advance.

            # if not look like json and exists move to other field and remove source
            if [body][message] !~ /{.*}/ and [body][message] {

                            mutate {
                                    add_field => { "message_text" => "%{[body][message]}"  }
                                    remove_field => [ "[body][message]" ]
                            }
                    }

[magnusbaeck (Magnus Bäck)]

Have you tried escaping the braces (which has a special meaning in regular expressions)? You should probably also use ^ and $ anchors so that you don't match braces anywhere in the string.

[rpuserh (Ruben Papovyan)]

Yes I tried no success.
But i have done it with ruby
This ruby solution I liked more as I'm checking if key value is JSON

ruby {
    code => "if event.get('[body][message]').class == Hash ;  event.set('message_text' , event.get('[body][message]')) ; event.remove('[body][message]')  end"
}