Regex in filter plugin not working

Elastic Stack Logstash
1

Hello,

I'm trying to tag one host by using syslog5424_host but it's not matching anything.

First, can I tag syslog5424_host? if yes can I use it directly in the output section and forward it to the destination instead of first tagging and then by using tag send it to the destination?

filter {
  if [syslog5424_host] = ~ /^sharedservices.prod.authorization-prod(...)/ {
    mutate {
      add_tag => ["Prod_Auth"]
    }
  }
}

The string I'm trying to match : sharedservices.prod.authorization-prod-16

2

Have you tried removing the parentheses around the three periods?

3

Yeah I did

I tried this as well : ^sharedservices.prod.authorization-prod.* its matching in ruby regex tester but not in logstash

4

If you use

output { stdout { codec => rubydebug } }

what does that field look like?

5

How do I see stdout in terminal?

6

If you are running as a service then you could try using a file output with a rubydebug codec.

7

I got it working I was forget to escape period

here is the working regex

^sharedservices\.prod\.authorization.*

8

But period in a regexp matches anything, including a period. It has to be the change at the end of the regexp that fixed it.