# Single forward slash in field not accessable in conditional filter

**URL:** <https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188>\
**Category:** Logstash\
**Created:** [November 7, 2016, 9:18am UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188 "2016-11-07T09:18:37Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nick.e](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nick.e](https://discuss.elastic.co/u/nick.e)\
**Post date:** [November 7, 2016, 9:18am UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188/1 "2016-11-07T09:18:37Z")

</div>

Hi,

I'm sending oracle auditing events with filebeat 5.0.0. The events itself are written to an xml-file by the oracle database.  
Sometimes, one field (DB\_User) contains a single **/**.  
It'd like to filter this slash in a logstash config. Obviously, it is not possible or I don't know the correct way.

Here is a sample part of the config:

> ```
> if ([AuditRecord][DB_User]) {
> mutate { add_tag => ["something"]}
> if ([AuditRecord][DB_User] == "/") {
> mutate { add_tag => ["condition"] }
> }
> if [AuditRecord][DB_User] =~ /\// {
> mutate { add_tag => ["regexp"] }
> }
> if [AuditRecord][DB_User] =~ "\/" {
> mutate { add_tag => ["regexp_2"] }
> }
> if [AuditRecord][DB_User] =~ /^\// {
> mutate { add_tag => ["regexp_3"] }
> }
> 
> ```

This config only adds the tag "something". None of the other tags is added.

This is the part of the JSON in Kibana:

> ```
> "AuditRecord": {
> "DB_User": [
> "/"
> ],
> 
> ```

And when trying to filter with Kibana by pressing the +, it shows following (although there are definitely hits)

 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/887f7446126c034f4dfe75d0d8d7c14774a290a8.png)

Thanks for your help!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 7, 2016, 12:19pm UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188/2 "2016-11-07T12:19:22Z")

</div>

`[AuditRecord][DB_User]` is an array and not a string. This should work:

```
if [AuditRecord][DB_User] == ["/"] { ... }
```

---

<div class="post-metadata">

**Author:** ![nick.e](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nick.e](https://discuss.elastic.co/u/nick.e)\
**Post date:** [November 7, 2016, 12:45pm UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188/3 "2016-11-07T12:45:33Z")

</div>

Thanks! this solved the issue.

I didn't expect the XML-Filter-Plugin to create an Array for every value.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 7, 2016, 12:47pm UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188/4 "2016-11-07T12:47:46Z")

</div>

It does, but that behavior can be disabled with an option.

---

<div class="post-metadata">

**Author:** ![nick.e](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nick.e](https://discuss.elastic.co/u/nick.e)\
**Post date:** [November 7, 2016, 12:58pm UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188/5 "2016-11-07T12:58:51Z")

</div>

Yes, I already did it.  
Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2016, 12:59pm UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188/6 "2016-12-05T12:59:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.