# Match multiple ip segment Regex

**URL:** https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484
**Category:** Logstash
**Created:** [September 14, 2017, 8:07am UTC](https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484 "2017-09-14T08:07:59Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sreejiths](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@sreejiths](https://discuss.elastic.co/u/sreejiths)
#### Post date: [September 14, 2017, 8:07am UTC](https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484/1 "2017-09-14T08:07:59Z")

</div>

Below is the if statement which is working fine

if [host] =~ "^10.255.212.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$" {  
mutate { add\_field =\> ["host\_group", "XXX"] }  
} else {  
mutate { add\_field =\> ["host\_group", "XX"] }  
}  
Query 1 : Will the above ip segment regex can be added in patterns to have the grok more simpler

Query 2 : If i have to match mutiple segments (AND or OR) in same if [host] , how can i achieve it ..Below one is not working

if [host] =~ "^10.255.212.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$" || "^10.255.214.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$" {  
mutate { add\_field =\> ["host\_group", "XXX"] }  
} else {  
mutate { add\_field =\> ["host\_group", "XX"] }  
}  
}

Please provide inputs ..

---

<div class="post-metadata">

### Author: ![sushanth](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@sushanth](https://discuss.elastic.co/u/sushanth)
#### Post date: [September 14, 2017, 9:27am UTC](https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484/2 "2017-09-14T09:27:04Z")

</div>

I am also new to logstash but an elseif would be easier at this point I think..

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 14, 2017, 9:44am UTC](https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484/3 "2017-09-14T09:44:07Z")

</div>

As documented, the logical disjunction operator is `or` and not `||`.

[https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html)

Secondly, each side of the disjunction must be a complete expression, i.e. `[host] =~ /.../ or [host] =~ /.../`, not `[host] =~ /.../ or /.../`.

Finally, you should look into the cidr filter.

---

<div class="post-metadata">

### Author: ![sreejiths](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@sreejiths](https://discuss.elastic.co/u/sreejiths)
#### Post date: [September 15, 2017, 6:57am UTC](https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484/4 "2017-09-15T06:57:52Z")

</div>

Thanks ..It works perfectly ..Appreciate your quick response and help

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 13, 2017, 6:58am UTC](https://discuss.elastic.co/t/match-multiple-ip-segment-regex/100484/5 "2017-10-13T06:58:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.