Regex in filter plugin not working


I'm trying to tag one host by using syslog5424_host but it's not matching anything.

First, can I tag syslog5424_host? if yes can I use it directly in the output section and forward it to the destination instead of first tagging and then by using tag send it to the destination?

filter {
  if [syslog5424_host] = ~ /^ {
    mutate {
      add_tag => ["Prod_Auth"]

The string I'm trying to match :

Have you tried removing the parentheses around the three periods?

Yeah I did

I tried this as well : ^* its matching in ruby regex tester but not in logstash

If you use

output { stdout { codec => rubydebug } }

what does that field look like?

How do I see stdout in terminal?

If you are running as a service then you could try using a file output with a rubydebug codec.

I got it working I was forget to escape period

here is the working regex


But period in a regexp matches anything, including a period. It has to be the change at the end of the regexp that fixed it.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.