# Negative look behind not working

**URL:** <https://discuss.elastic.co/t/negative-look-behind-not-working/67329>\
**Category:** Logstash\
**Created:** [November 28, 2016, 10:52am UTC](https://discuss.elastic.co/t/negative-look-behind-not-working/67329 "2016-11-28T10:52:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Arthur\_Francis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arthur_francis/32/13065_2.png) [@Arthur\_Francis](https://discuss.elastic.co/u/Arthur_Francis)\
**Post date:** [November 28, 2016, 10:52am UTC](https://discuss.elastic.co/t/negative-look-behind-not-working/67329/1 "2016-11-28T10:52:44Z")

</div>

I am trying to match a line in the logfile which does not start with "Caused by" but the negative lookbehind I am using is not working, even though it works in the grok debugger and also in rubular ([http://rubular.com/r/N3AzySNHiS](http://rubular.com/r/N3AzySNHiS)) but does not work in logstash

```
grok {
        patterns_dir => ["./patterns"]
        match => ["message", "%{GREEDYDATA}\n%{JAVA_EXCEPTION_SHORT:exception}"]
}

```

Regex  
`^(?!Caused by: ).*?Exception`

Message

```
> 2016-11-15 05:19:28,801 ERROR [App-Initialisation-Thread] appengine.java:520 Failed to initialize external authenticator myapp Support Access || appuser@vm23-13:/mnt/data/install/assembly app-1.4.12@cad85b224cce11eb5defa126030f21fa867b0dad
> java.lang.IllegalArgumentException: Could not check if provided root is a directory
> at com.myapp.jsp.KewServeInitContextListener$1.run(QServerInitContextListener.java:104)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.nio.file.NoSuchFileException: fh-ldap-config/
> at com.upplication.s3fs.util.S3Utils.getS3ObjectSummary(S3Utils.java:55)
> at com.upplication.s3fs.util.S3Utils.getS3FileAttributes(S3Utils.java:64)

```

Logstash Result  
`"exception" => "Caused by: java.nio.file.NoSuchFileException"`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2016, 10:52am UTC](https://discuss.elastic.co/t/negative-look-behind-not-working/67329/2 "2016-12-26T10:52:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.