# Not able to make a fileld conditional in grok

**URL:** <https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242>\
**Category:** Logstash\
**Created:** [November 27, 2017, 3:11pm UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242 "2017-11-27T15:11:46Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![George\_Cherian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_cherian/32/25879_2.png) [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\
**Post date:** [November 27, 2017, 3:11pm UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/1 "2017-11-27T15:11:46Z")

</div>

The grok filter what is written is as follows:  
grok {  
match =\> { "correlationid:" =\> "(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})?" }  
}  
For the below text it is not showing the output:  
"correlationid:" =\> "1000 | callhalf-1388133:0 | 3886c145-b301-4914-b4a4-dab2d5614aca"

But when I try the above filter without ? its working , when I tried after removiing the ?  
grok {  
match =\> { "correlationid:" =\> "(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})" }  
}

```
"correlationid:" => "1000 | callhalf-1388133:0 | 3886c145-b301-4914-b4a4-dab2d5614aca",
           "CID" => "3886c145-b301-4914-b4a4-dab2d5614aca"

```

Could anyone help me out?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 27, 2017, 8:59pm UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/2 "2017-11-27T20:59:10Z")

</div>

Please make sure to format your configuration snippets as preformatted text (e.g. using the `</>` toolbar button) so we can see exactly what configuration you have.

---

<div class="post-metadata">

**Author:** ![George\_Cherian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_cherian/32/25879_2.png) [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\
**Post date:** [November 28, 2017, 5:13am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/3 "2017-11-28T05:13:39Z")

</div>

Hi Magnus,  
Please find the below formatted text

```
grok {
match => { "correlationid:" => "(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})?" }
}

```

For the below text it is not showing the output:  
"correlationid:" =\> "1000 | callhalf-1388133:0 | 3886c145-b301-4914-b4a4-dab2d5614aca"  
But when I try the above filter without ? its working

```
grok {
match => { "correlationid:" => "(?\w{8}-\w{4}-\w{4}-\w{4}-\w{12})" }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 28, 2017, 6:24am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/4 "2017-11-28T06:24:34Z")

</div>

I'm still confused. What's the point of the question mark at the opening of the parenthesis? And what's the overall point of the grok filter since you're not capturing any fields from it?

---

<div class="post-metadata">

**Author:** ![George\_Cherian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_cherian/32/25879_2.png) [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\
**Post date:** [November 28, 2017, 6:44am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/5 "2017-11-28T06:44:00Z")

</div>

Sorry Magnus,  
Really sorry for the mistake made:

```
grok {
                     match => { "correlationid:" => "(?<CID>\w{8}-\w{4}-\w{4}-\w{4}-\w{12})?" }

```

This is not getting matched for the below line  
Input  
"correlationid:" =\> "1000 | callhalf-1388133:0 | **3886c145-b301-4914-b4a4-dab2d5614aca**"

I am using ? because this(CID) field is optional in my log.

But, when I Try the above grok filter without ? as shown below it is fetching the field

```
 grok {
                         match => { "correlationid:" => "(?<CID>\w{8}-\w{4}-\w{4}-\w{4}-\w{12})" }

```

Output:  
"CID" =\> "3886c145-b301-4914-b4a4-dab2d5614aca"

I wanted to clarify if there is any mistake in the syntax or format I am applying (?) the conditional operator.

Thanks  
George

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 28, 2017, 8:42am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/6 "2017-11-28T08:42:53Z")

</div>

It seems the regexp engine chooses the simplest possible solution in this case, which is no match. Appending `$` to the end of the expression fixes this problem. I'm not sure why.

---

<div class="post-metadata">

**Author:** ![George\_Cherian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_cherian/32/25879_2.png) [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\
**Post date:** [November 28, 2017, 9:08am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/7 "2017-11-28T09:08:00Z")

</div>

> [@magnusbaeck](#):
>
> chooses the simplest possible solution in this cas

Thanks Magnus ...It worked 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2017, 9:08am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242/8 "2017-12-26T09:08:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.