Usage of "or" operator in logstash grok filters


I have a condition to check if the 7th-word matches either /list/ or /list or /simple/ or /simple using below condition

[@metadata][copyOfMessage][6] =~ /^\/list\// or /^\/list/ or /^\/simple\// or /^\/simple/

This is not working because all the requests are passing through this condition. Is there a different way to check this?

Try use (|)

((/^\/list\// | /^\/list/ | /^\/simple\// | /^\/simple/)

In my pipiline ai used in gsub:

(^\t|Processing Request,\s|Invoke Action,\s|Check Row,\s|Row in violation,\s|\s+seconds)


I've tried this
elseif [@metadata][copyOfMessage][6] =~ (/^\/list\// | /^\/list/ | /^\/simple\// | /^\/simple/) but it gives me syntax error

I thing that is resolve:


I've got the same syntax error

Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, \", ', / at line 31, column 47 (byte 995) after filter {\n # Create a copy of original message\n mutate {\n add_field => {\n \"[@metadata][copyOfMessage]\" => \"%{[message]}\"\n }\n }\n # split message\n mutate {\n split => {\n \"[@metadata][copyOfMessage]\" => \"|\"\n }\n }\n grok {\n break_on_match => false\n

  elseif [@metadata][copyOfMessage][6] =~ ((^/list/|^/list)|(^/simple/|^/simple)) {

Surround the regexp with / and /

I've tried testing with

/(/^/list// or /^/list/ or /^/simple// or /^/simple/)/

and it has syntax errors. Is this what you suggested to try?

Yes. Does this work for you?...


Yes sir. Thank you!


After @Badger give me helps, I found a good website that helps with regexp in ruby:

Maybe will help you in next.

Thank you! @Thiago_Paiva

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.