# Patterns : Logstash - Regular Expression HELP!

**URL:** <https://discuss.elastic.co/t/patterns-logstash-regular-expression-help/115269>\
**Category:** Logstash\
**Created:** [January 12, 2018, 10:25am UTC](https://discuss.elastic.co/t/patterns-logstash-regular-expression-help/115269 "2018-01-12T10:25:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\
**Post date:** [January 12, 2018, 10:25am UTC](https://discuss.elastic.co/t/patterns-logstash-regular-expression-help/115269/1 "2018-01-12T10:25:00Z")

</div>

I'm using the Logstash "pattern" to select out a specific pattern inside the "message" field.

Following is the message

> Blockquote  
> January 12th 2018, 15:47:52.228 Jan 12 15:47:51 198.18.109.70 interface,info ether7 link down  
> January 12th 2018, 15:47:52.228 Jan 12 15:47:51 203.143.61.15 route,bgp,info RemoteAddress=198.18.43.154  
> January 12th 2018, 15:47:52.228 Jan 12 15:47:51 203.143.61.15 route,bgp,info Failed to open TCP connection: No route to host  
> January 12th 2018, 15:47:51.226 Jan 12 15:47:50 198.18.13.44 dhcp,info MAIN assigned 172.16.219.87 to 24:A0:74:5F:C6:FE  
> January 12th 2018, 15:47:51.226 Jan 12 15:47:50 198.18.109.70 interface,info ether7 link up (speed 10M, full duplex)

From the above content I want to have a filed which will filter out "route,bgp" messages.

I tried the following pattern but it's not working ..

> Blockquote  
> cat pattern  
> BGP\_TEST ._bgp._

> Blockquote  
> input {  
> file {  
> path =\> "/var/log/syslog"  
> type =\> "syslog"  
> }  
> }  
> filter {  
> if [type] == "syslog" {  
> grok {  
> patterns\_dir =\> ["/etc/logstash/conf.d/patterns"]  
> match =\> { "message" =\> "%{IP:client}" }  
> match =\> { "message" =\> "%{BGP\_TEST:bgp}" }  
> }  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> "203.143.21.227"  
> }  
> }

---

<div class="post-metadata">

**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\
**Post date:** [January 13, 2018, 8:00am UTC](https://discuss.elastic.co/t/patterns-logstash-regular-expression-help/115269/2 "2018-01-13T08:00:49Z")

</div>

Any Help ???

---

<div class="post-metadata">

**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\
**Post date:** [January 16, 2018, 6:14am UTC](https://discuss.elastic.co/t/patterns-logstash-regular-expression-help/115269/3 "2018-01-16T06:14:15Z")

</div>

Any HELP 😣

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2018, 6:14am UTC](https://discuss.elastic.co/t/patterns-logstash-regular-expression-help/115269/4 "2018-02-13T06:14:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.