# Regexp in conditional **URL:** \ **Category:** Logstash\ **Created:** [August 7, 2019, 11:31am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223 "2019-08-07T11:31:42Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [August 7, 2019, 11:31am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/1 "2019-08-07T11:31:42Z")
Hi, I'm trying to apply a tag based on the contents of a field. I've been trying it like this: ``` if [field.keyword] =~ /^(TEST|test)-.*$/ { mutate { add_tag => ["TEST"] } } } ``` The above does not work, the tag never gets applied even though the contents of the field looks like this: TEST-somedata or test-somedata What is the issue with the regex above? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 7, 2019, 11:34am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/2 "2019-08-07T11:34:57Z")
Does your field name have a period in it, or is your field an object with a keyword field inside? If it is the latter then use [field][keyword]. ---
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [August 7, 2019, 11:51am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/3 "2019-08-07T11:51:25Z")
You're right about the object with a keyword field inside it, i've changed it to [field][keyword] but the problem still persists. The tag "TEST" is not being applied even though the contents of the field contains TEST-SOMEDATA. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 7, 2019, 11:56am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/4 "2019-08-07T11:56:57Z")
Well the regex works. If I run ``` mutate { add_field => { "[field][keyword]" => "TEST-SOMEDATA" } } if [field][keyword] =~ /^(TEST|test)-.*$/ { mutate { add_tag => ["TEST"] } } ``` then the tag gets added. I see that you have an extra } on the mutate filter. Is that intended? ---
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [August 7, 2019, 12:09pm UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/5 "2019-08-07T12:09:43Z")
Hmm, i think there is something wrong with this configuration, but it still runs.. ``` filter { if "syslog" in [tags] or "syslog-tcp" in [tags] and "pre-processed" not in [tags] { if "test" in [ServiceName] { mutate { add_tag => ["test2"] } grok { patterns_dir => ["/etc/logstash/conf.d/patterns"] break_on_match => false match => [ "message", "NetworkDeviceName=%{HOSTNAME:KundID-SiteID}", "message", "NOTICE Passed-Authentication: %{CISCO_REASON:Authentication}", "message", "NOTICE Failed-Attempt: %{CISCO_REASON:Authentication}", "message", "NAS-IP-Address=%{IP:Switch_IP}", "message", "Framed-IP-Address=%{IP:Client_IP}", "message", "NAS-Port-Id=%{NOTSPACE:Switch_port}", "message", "Calling-Station-ID=%{MAC:Client_MAC_address}", "message", "Response={User-Name=%{PROG:Authenticator_ID}", "message", "Response=\\{User-Name=%{MAC:Authenticator_ID}", "message", "Response={UserName=%{MAC:Authenticator_ID}", "message", "Response=\\{UserName=%{MAC:Authenticator_ID}", "message", "EndPointMACAddress=%{MAC:Client_MAC_address}", "message", "NetworkDeviceGroups=Location(?(#.*?)\,)", "message", "SelectedAuthorizationProfiles=%{USERNAME:auth_profile}", "message", "PostureAssessmentStatus=%{HOSTNAME:posture_status}" ] } mutate { gsub => [ # remove all "," on field Switch_port "Switch_port", ",", "", # remove all ";\" on field Authenticator_ID "Authenticator_ID", "[;\\]", "" ] } if [KundID-SiteID][keyword] =~ /^(TEST|test)-.*$/ { mutate { add_tag => ["TEST"] } } } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 7, 2019, 12:34pm UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/6 "2019-08-07T12:34:06Z")
The .keyword field does not exist until the data is ingested into elasticsearch. In logstash you should test ``` if [KundID-SiteID] =~ /^(TEST|test)-.*$/ { ``` ---
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [August 8, 2019, 6:55am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/7 "2019-08-08T06:55:05Z")
This worked, thank you for the assistance! I have another question, the GROK fields only shows in the first ELK stack, not the second in which we forward the same events. Is there a way to keep the fields being applied by the first logstash instance in order to prevent performing the same grok operations again? Hopefully that makes sense 🙂 ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 8, 2019, 11:59am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/8 "2019-08-08T11:59:56Z")
If you are forwarding the entire event it should retain any fields you are adding using grok. If you just forward the original [message] field then it will not. How are you forwarding events? ---
**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Post date:** [August 9, 2019, 5:59am UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/9 "2019-08-09T05:59:55Z")
Like this: ``` syslog { host => "host.example.com" port => 514 protocol => "tcp" id => "syslog_output_example" } ``` Perhaps i should specify the "message" parameter to something else other than the default %{message} ? Would %{\_source} work? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 9, 2019, 12:59pm UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/10 "2019-08-09T12:59:22Z")
You are using syslog output and input to move events between logstash instances? I would suggest switching to a lumberjack output and a beats input. If you are really married to syslog you can do something like [this](https://discuss.elastic.co/t/logstash-output-syslog-full-json-in-message/142642/6) to send the entire event. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 6, 2019, 12:59pm UTC](https://discuss.elastic.co/t/regexp-in-conditional/194223/11 "2019-09-06T12:59:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.