# Weird behavior with regexp conditionals

**URL:** <https://discuss.elastic.co/t/weird-behavior-with-regexp-conditionals/29804>\
**Category:** Logstash\
**Created:** [September 22, 2015, 7:17pm UTC](https://discuss.elastic.co/t/weird-behavior-with-regexp-conditionals/29804 "2015-09-22T19:17:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![spynxo](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@spynxo](https://discuss.elastic.co/u/spynxo)\
**Post date:** [September 22, 2015, 7:17pm UTC](https://discuss.elastic.co/t/weird-behavior-with-regexp-conditionals/29804/1 "2015-09-22T19:17:02Z")

</div>

Hi All,

I am getting a weird behavior with regexp conditionals.

I am using Logstash 1.5.4. The logs I am parsing should have the following format under normal conditions: `Tue Sep 22 18:34:16 UTC 2015: Log Message`

I want to mark all logs that start with that date pattern as `INFO` and logs that start with some other string as `ERROR`. In order to do this I am using a regexp conditional to determine if the line starts with that date pattern.

The problem is that this seems to work 99.9% of the times, but every once in a while I get a false positive. The regexp is failing to match a log messages that has the correct pattern. I've re-processed these messages using the same filter and it successfully matches the pattern the second time around.

This is the filter I am using:

```
filter
{
    if [type] == "mylog"
    {
        if [message] =~ /^[a-zA-Z]+\s[a-zA-Z]+\s+[0-9]+\s[0-9]+:[0-9]+:[0-9]+\s[a-zA-Z]+\s[0-9]+:/
        {
            #parse log message
            mutate
            {
                add_field => { "severity" => "INFO" }
            }
        }else
        {
            mutate
            {
                add_field => { "severity" => "ERROR" }
            }
        }
    }
}

```

Have you guys run into a similar issue? Do you have any suggestions? What would be a good workaround?

Thanks!

---

<div class="post-metadata">

**Author:** ![PhaedrusTheGreek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phaedrusthegreek/32/4884_2.png) [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\
**Post date:** [September 23, 2015, 2:15pm UTC](https://discuss.elastic.co/t/weird-behavior-with-regexp-conditionals/29804/2 "2015-09-23T14:15:49Z")

</div>

This is disturbing because computers are usually so consistent 😄

If you have a reproducible margin of 1% false positive, then please share some sample input with me via S3 or Dropbox, or the like, and I will attempt to reproduce it on my end.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:28am UTC](https://discuss.elastic.co/t/weird-behavior-with-regexp-conditionals/29804/3 "2017-07-06T05:28:16Z")

</div>

Closed on July 6, 2017, 5:28am UTC