Need help with conditional only if field contains a period

Elastic Stack Logstash
1

I'm trying to grok the host name field only if it contains a period using the conditional below:
if ([host][name] =~ ".") { grok host.name field }

For some reason, when the host name field doesn't contain a period, I get _grokparsefailure. I'm confused as to why this is happening. I would think if there's no period, the conditional won't be satisfied & the grok statement won't be executed. It seems like it is anyway.

I also tried this & it produces the same outcome
if ([host][name] =~ /./) { grok host.name field }

Any advice?

2

From the documentation:

  • regexp: =~ , !~ (checks a pattern on the right against a string value on the left)

So, the expression =~ "." or =~ /./ will make it match anything.

The conditional that you need to use in this case is:

if "." in [host][name]  { grok [host][name] field }

This will check if a literal . is a substring of the field [host][name].

1 Like
3

That did the trick. Thanks @leandrojmp

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.