# Using expression in Elastic search

**URL:** <https://discuss.elastic.co/t/using-expression-in-elastic-search/121428>\
**Category:** Logstash\
**Created:** [February 26, 2018, 4:31am UTC](https://discuss.elastic.co/t/using-expression-in-elastic-search/121428 "2018-02-26T04:31:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bismayam](https://avatars.discourse-cdn.com/v4/letter/b/e5b9ba/32.png) [@bismayam](https://discuss.elastic.co/u/bismayam)\
**Post date:** [February 26, 2018, 4:31am UTC](https://discuss.elastic.co/t/using-expression-in-elastic-search/121428/1 "2018-02-26T04:31:35Z")

</div>

We have logs like below.

2018-02-24 18:24:21 GET /test/customer/api/abc/getCustomer  
2018-02-24 18:24:21 GET /test/customer/10000  
2018-02-24 18:24:21 GET /test/customer/10000/updateCustomer

We are trying to parse apiname as last word and excluding numerical values by reg exp like below. Because we don't want customer id 10000 should come as apiname.

%{GREEDYDATA}/(?[^//][a-zA-Z^]\*$+)

If we are testing this expression then it is working fine. But once we configure this in beats.conf it failed to parse log line 2. We tried to remove failed parse result by below. But we only see parsed result for only line 1. Not line 3.

if "\_grokparsefailure" in [tags] {  
drop { }  
}

Could you please help here.

---

<div class="post-metadata">

**Author:** ![bismayam](https://avatars.discourse-cdn.com/v4/letter/b/e5b9ba/32.png) [@bismayam](https://discuss.elastic.co/u/bismayam)\
**Post date:** [February 26, 2018, 8:23am UTC](https://discuss.elastic.co/t/using-expression-in-elastic-search/121428/2 "2018-02-26T08:23:10Z")

</div>

Hi,

After checking we found that %{GREEDYDATA}/(?[^//][a-zA-Z^\s]\*$+) is working fine. But in our log we have response code like below.

2018-02-24 18:24:21 GET /test/customer/10000 200

How can we append another field in that expression. We tried below but not working.  
%{GREEDYDATA}/(?[^/][a-zA-Z^\s]+) %{SPACE}%{NUMBER:responseCode}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2018, 8:23am UTC](https://discuss.elastic.co/t/using-expression-in-elastic-search/121428/3 "2018-03-26T08:23:16Z")

</div>

Closed on March 26, 2018, 8:23am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.