# Match specific word in grok filter
**URL:** https://discuss.elastic.co/t/match-specific-word-in-grok-filter/192299
**Category:** Logstash
**Created:** [July 25, 2019, 7:00pm UTC](https://discuss.elastic.co/t/match-specific-word-in-grok-filter/192299 "2019-07-25T19:00:35Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)
#### Post date: [July 25, 2019, 7:00pm UTC](https://discuss.elastic.co/t/match-specific-word-in-grok-filter/192299/1 "2019-07-25T19:00:35Z")
I have a log message which is composed of multiple values joined by pipes.
`20190615|4|method|userend|/test/value/123/1.1|500|2`
mY grok filter:
```
mutate {
add_field => {
"[@metadata][copyOfMessage]" => "%{[message]}"
}
}
# split message
mutate {
split => {
"[@metadata][copyOfMessage]" => "|"
}
}
if [@metadata][copyOfMessage][4] =~ /^\/test/ {
grok {
# Enable multiple matchers
break_on_match => false
match => { "message" => "%{DATA:timestamp_local}\|%{NUMBER:duration}\|%{WORD:requesttype}\|%{DATA:username}\|%{DATA:resource}\|%{NUMBER:statuscode}\|%{NUMBER:bytes}" }
# Extract repo and path
match => { "resource" => "/%{DATA:repo}/%{GREEDYDATA:resource_path}"}
# Extract resource name
match => { "resource_path" => "(?[^/]+$)" }
}
}
```
For some reason, my IF condition doesn't work perfectly and that block gets executed for every word which starts with "test".
My initial requirement was to send a message through grok filter only if [@metadata][copyOfMessage][4] =~ /^/test/ is true but the filter gets executed if the 5th value is "testing" or "tester". I only need to send the message through the filter if the 5th value is "test"
So,
I have tried something like below,
**[@metadata][copyOfMessage][4] =~ /^/test/ and [@metadata][copyOfMessage][5] =~ /^/value/**
and the whole block doesnt get exectued.
what can I do to match the exact word "test"?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 25, 2019, 7:43pm UTC](https://discuss.elastic.co/t/match-specific-word-in-grok-filter/192299/2 "2019-07-25T19:43:37Z")
> [@naveenrt23](#):
>
> if [@metadata][copyOfMessage][4] =~ /^/test/
This tests whether it matches a regexp. If you want an exact string comparison then use
```
if [@metadata][copyOfMessage][4] == "test"
```
If you want to test whether the string starts with /test/ then use
```
if [@metadata][copyOfMessage][4] =~ /^\/test\//
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2019, 7:43pm UTC](https://discuss.elastic.co/t/match-specific-word-in-grok-filter/192299/3 "2019-08-22T19:43:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.