# Pattern matching in Logstash

**URL:** https://discuss.elastic.co/t/pattern-matching-in-logstash/95622
**Category:** Logstash
**Created:** [August 3, 2017, 12:05am UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622 "2017-08-03T00:05:11Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Deepthi\_V](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@Deepthi\_V](https://discuss.elastic.co/u/Deepthi_V)
#### Post date: [August 3, 2017, 12:05am UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622/1 "2017-08-03T00:05:12Z")

</div>

Hi All,

I am calling Logstash using stdin like shown below:

/opt/logstash/bin/logstash agent -e 'input { file { path =\> "/home/dv/Desktop/log\_output/input/\*\*/\*.log" codec =\> multiline { pattern =\> "^\s" what =\> "previous" } start\_position =\> beginning ignore\_older =\> 0 sincedb\_path =\> "/dev/null" } }' -f /etc/logstash/conf.d/pipeline.conf

I am accessing the "path" in my configuration file and I want to check if the "path" contains words like "alerts","var" etc, so that different grok patterns get applied on it.

So far I have tried:

1. if [path] =~ "alerts"
2. if "alerts" in [path]

But it does not seem to work. Can anybody please help with this ASAP!

Thanks in advance.

Deepthi

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 3, 2017, 8:11am UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622/2 "2017-08-03T08:11:56Z")

</div>

Please use a `stdout { codec => rubydebug }` output to show us what your log entries look like. Preferably show us an example that contains "alerts".

---

<div class="post-metadata">

### Author: ![Deepthi\_V](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@Deepthi\_V](https://discuss.elastic.co/u/Deepthi_V)
#### Post date: [August 3, 2017, 8:23am UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622/3 "2017-08-03T08:23:25Z")

</div>

Hello Magnus,

I was able to resolve this.

Thank you for your reply.

Regards,  
Deepthi

---

<div class="post-metadata">

### Author: ![prydeep](https://avatars.discourse-cdn.com/v4/letter/p/c6cbf5/32.png) [@prydeep](https://discuss.elastic.co/u/prydeep)
#### Post date: [August 7, 2017, 2:28pm UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622/4 "2017-08-07T14:28:25Z")

</div>

Hey, Can you tell me how you fixed this issue? thanks

---

<div class="post-metadata">

### Author: ![Deepthi\_V](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@Deepthi\_V](https://discuss.elastic.co/u/Deepthi_V)
#### Post date: [August 7, 2017, 7:03pm UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622/5 "2017-08-07T19:03:50Z")

</div>

It was a silly mistake from my side. I had removed the path field in the filter section but I was trying to access it in the output section. I just corrected that.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2017, 7:03pm UTC](https://discuss.elastic.co/t/pattern-matching-in-logstash/95622/6 "2017-09-04T19:03:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.