# Wildcard matches in logstash filters

**URL:** <https://discuss.elastic.co/t/wildcard-matches-in-logstash-filters/152445>\
**Category:** Logstash\
**Created:** [October 15, 2018, 8:08am UTC](https://discuss.elastic.co/t/wildcard-matches-in-logstash-filters/152445 "2018-10-15T08:08:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [October 15, 2018, 8:08am UTC](https://discuss.elastic.co/t/wildcard-matches-in-logstash-filters/152445/1 "2018-10-15T08:08:18Z")

</div>

Hi, I want to match every ip adress that starts with 10.99 in our field "dst\_ip".

This is our logstash conf:

```
filter {
  if "syslog" in [tags] and "pre-processed" not in [tags] {
    if "test" in [field1] {
        mutate {
            add_tag => ["testtag"]
        }
        grok {
        patterns_dir => ["/etc/logstash/conf.d/patterns"]
        break_on_match => false
        match => [
            "message", "Context: %{USERNAME:context}",
            "message", "SrcIP: %{IP:src_ip}",
            "message", "IngressZone: %{USERNAME:ingress_zone}",
            "message", "EgressZone: %{USERNAME:egress_zone}",
            "message", "AccessControlRuleAction: %{WORD:action}",
            "message", "DstIP: %{IP:dst_ip}",
            "message", "Protocol: %{WORD:protocol}",
            "message", "SrcPort: %{NUMBER:src_port}",
            "message", "DstPort: %{NUMBER:dst_port}",
            "message", "DNSQuery: %{USERNAME:dns_query}",
            "message", "URLReputation: %{CISCO_REASON:risk}",
            "message", "IngressInterface: %{NOTSPACE:ingress_interface}",
            "message", "EgressInterface: %{NOTSPACE:egress_interface}",
            "message", "URL: %{URI:URL}",
            "message", "AccessControlRuleReason: %{CISCO_REASON:reason}",
            "message", "^%{SYSLOG5424PRI}%{CISCOTIMESTAMP} ipfiresight01 SFIMS: \[%{PROG}] %{QS:classification_detailed} \[Impact: %{CISCO_REASON:impact}] From %{QS} at %{HTTPDERROR_DATE} UTC \[Classification: %{CISCO_REASON:classification}] \[Priority: %{NUMBER:priority}] \{%{WORD:protocol}} %{IP:src_ip}:%{NUMBER} \(%{WORD:geotag}\)->%{IP:dst_ip}:%{NUMBER:dst_port} \(%{WORD}%{GREEDYDATA}$"
        ]
        }
        geoip {
        source => "src_ip"
        target => "geoip"
       }
       if "10.99.*" in [dst_ip] {
          mutate {
            add_tag => ["another_tag"]
        }
      }
    }
  }
}

```

However, when i view documents in kibana that has 10.99._._ in [dst\_ip] the documents have not gotten the tag "another\_tag" which indicates to me that my conditional "if" does not work. Is there a trick to getting wildcard IP matches to work with filters in logstash?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 15, 2018, 8:23am UTC](https://discuss.elastic.co/t/wildcard-matches-in-logstash-filters/152445/2 "2018-10-15T08:23:47Z")

</div>

I think your condition should look something like this:

```auto
if [dst_ip] =~ /10\.99\..*/ {
   mutate {
     add_tag => ["another_tag"]
   }
 }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2018, 8:38am UTC](https://discuss.elastic.co/t/wildcard-matches-in-logstash-filters/152445/3 "2018-11-12T08:38:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.