# Logstash wildcard

**URL:** <https://discuss.elastic.co/t/logstash-wildcard/246121>\
**Category:** Logstash\
**Created:** [August 24, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121 "2020-08-24T13:19:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 24, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121/1 "2020-08-24T13:19:04Z")

</div>

Logstash recieves many `.log` files such as `mongod.log` and `mysqld.log`. I deal with it in logstash by having an `if` statement for each file such as:

`if [log][file][path] =~ "mysqld.log"`

I've been asked to also ship data from some old servers where on top of `mysqld.log`, there's also `mysqld-port3308.log`. The port number varies and can be anything.

Because the content of these files are formatted the same, I'm trying to have logstash simply include anything that starts with `mysql` and ends with `.log`. Basically `mysql*.log`

I noticed it doesn't accept astriks, is there an alternative for this? Huge thanks ahead!

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 24, 2020, 1:47pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121/2 "2020-08-24T13:47:14Z")

</div>

> [@headtea](#):
>
> mysql\*.log

The regular expression for that is `/mysql.*\.log$/`.

- `mysql` matches the characters mysql literally (case sensitive)
- `.*` matches any character (except for line terminators)
  - `*` **Quantifier** — Matches between zero and unlimited times, as many times as possible, giving back as needed (greedy)

- `\.` matches the character . literally (case sensitive)
- `log` matches the characters log literally (case sensitive)
- `$` asserts position at the end of a line

(See [https://regex101.com/](https://regex101.com/) for regex explanations)

(Edit: You might want to use `/mysql[^\/]*?\.log$/`, so it doesn't match paths like `mysqldfh/dsjf.log`)

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 24, 2020, 4:42pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121/3 "2020-08-24T16:42:14Z")

</div>

Thank you SO MUCH for the response!

If I may, I only didn't understand the `$` part. May I ask what asserts position at the end of a line - means?

Thanks ahead.

EDIT: btw, am I supposed to change somehting in the regex101 website? I want to learn to use it and when I paste the command it says there's an error [https://i.imgur.com/cJuErCm.png](https://i.imgur.com/cJuErCm.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 24, 2020, 5:12pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121/4 "2020-08-24T17:12:49Z")

</div>

The regex101 web site supplies the leading and trailing / that surround the regular expression, so you would just enter

```
mysql.*\.log$

```

The $ anchors the expression to the end of line, so there cannot be any characters after .log

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2020, 5:12pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121/5 "2020-09-21T17:12:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.