Usage of "or" operator in logstash grok filters

Elastic Stack Logstash
1

Hello,

I have a condition to check if the 7th-word matches either /list/ or /list or /simple/ or /simple using below condition

[@metadata][copyOfMessage][6] =~ /^\/list\// or /^\/list/ or /^\/simple\// or /^\/simple/

This is not working because all the requests are passing through this condition. Is there a different way to check this?

2

Try use (|)

((/^\/list\// | /^\/list/ | /^\/simple\// | /^\/simple/)

In my pipiline ai used in gsub:

(^\t|Processing Request,\s|Invoke Action,\s|Check Row,\s|Row in violation,\s|\s+seconds)

att

3

I've tried this
elseif [@metadata][copyOfMessage][6] =~ (/^\/list\// | /^\/list/ | /^\/simple\// | /^\/simple/) but it gives me syntax error

4

I thing that is resolve:

((^/list/|^/list)|(^/simple/|^/simple))

5

I've got the same syntax error

Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, \", ', / at line 31, column 47 (byte 995) after filter {\n # Create a copy of original message\n mutate {\n add_field => {\n \"[@metadata][copyOfMessage]\" => \"%{[message]}\"\n }\n }\n # split message\n mutate {\n split => {\n \"[@metadata][copyOfMessage]\" => \"|\"\n }\n }\n grok {\n break_on_match => false\n

  elseif [@metadata][copyOfMessage][6] =~ ((^/list/|^/list)|(^/simple/|^/simple)) {
6

Surround the regexp with / and /

7

I've tried testing with

/(/^/list// or /^/list/ or /^/simple// or /^/simple/)/
/((^/list/|^/list)|(^/simple/|^/simple))/

and it has syntax errors. Is this what you suggested to try?

8

Yes. Does this work for you?...

/^\/(list|simple)($|\/)/
9

Yes sir. Thank you!

10

Sir,

After @Badger give me helps, I found a good website that helps with regexp in ruby:
https://rubular.com

Maybe will help you in next.

11

Thank you! @Thiago_Paiva

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.