# Partially match beat fields

**URL:** <https://discuss.elastic.co/t/partially-match-beat-fields/196194>\
**Category:** Logstash\
**Created:** [August 21, 2019, 9:22pm UTC](https://discuss.elastic.co/t/partially-match-beat-fields/196194 "2019-08-21T21:22:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattsdevop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattsdevop/32/45160_2.png) [@mattsdevop](https://discuss.elastic.co/u/mattsdevop)\
**Post date:** [August 21, 2019, 9:22pm UTC](https://discuss.elastic.co/t/partially-match-beat-fields/196194/1 "2019-08-21T21:22:32Z")

</div>

I see some other topics on partial matches for [message]. But, I can't find any topics on partial matches for [fields][value] that's sent from filebeat.  
My situation is that I have the name of a program followed by a version as [fields][product] sent to logstash. It's ingested and displays as it should in Kibana. I want to run a different grok depending on the software that's in the [product] field. It seems partial matching isn't working against this field. I even tried regexp to match field to string.  
Example [fields][product]:  
Outlook 2019

```auto
"fields" => {
         "product" => [
            [0] "Outlook 2019"
        ],
         "service" => "Service",
             "env" => [
            [0] "QA"
        ],
        "customer" => [
            [0] "customer1"
        ]
    }

```

another one might be:  
Outlook 2017

```auto
"fields" => {
         "product" => [
            [0] "Outlook 2017"
        ],
         "service" => "Service",
             "env" => [
            [0] "QA"
        ],
        "customer" => [
            [0] "customer1"
        ]
    }

```

Since the same customer could be using multiple versions of software, the desired configuration is that I can match on "Outlook" in the logstash "if" statement such as this:

```auto
if "Outlook" in [fields][product] {
 grok {
  ...
 }
}

```

That doesn't work for some reason. I've also tried:

```auto
if [fields][product] =~ /^Outlook/ {
 grok {
  ...
 }
}

```

Of course a full match works, like:

```auto
if "Outlook 2019" in [fields][product] {
 grok {
  ...
 }
}

```

but it leaves out the rest of the logs that are using a different version. Can someone point me in the right direction?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 21, 2019, 9:35pm UTC](https://discuss.elastic.co/t/partially-match-beat-fields/196194/2 "2019-08-21T21:35:06Z")

</div>

> [@mattsdevop](#):
>
> if [fields][product] =~ /^Outlook/ {

It is an array, so

```
if [fields][product][0] =~ /^Outlook/ {

```

---

<div class="post-metadata">

**Author:** ![mattsdevop](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattsdevop/32/45160_2.png) [@mattsdevop](https://discuss.elastic.co/u/mattsdevop)\
**Post date:** [August 22, 2019, 1:44pm UTC](https://discuss.elastic.co/t/partially-match-beat-fields/196194/3 "2019-08-22T13:44:50Z")

</div>

Thanks for the tip!  
I tried both ways. And, they both work. For others coming here, @Badger solution works exactly as posted. And, the other way I was going for it also works:

```auto
if "Outlook" in [fields][product][0]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2019, 1:44pm UTC](https://discuss.elastic.co/t/partially-match-beat-fields/196194/4 "2019-09-19T13:44:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.