# Working with brackets in regex

**URL:** <https://discuss.elastic.co/t/working-with-brackets-in-regex/146958>\
**Category:** Logstash\
**Created:** [September 1, 2018, 10:14pm UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958 "2018-09-01T22:14:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fishfox](https://avatars.discourse-cdn.com/v4/letter/f/bb73d2/32.png) [@fishfox](https://discuss.elastic.co/u/fishfox)\
**Post date:** [September 1, 2018, 10:14pm UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958/1 "2018-09-01T22:14:17Z")

</div>

I have a regex if statement that includes brackets:

```
  if [prog] =~ /^openvpn[[0-9]*]$/ {
    grok {
      match => ["message", "%{IP:remote_ip}:%{POSINT:remote_port} \[%{USERNAME:username}\] %{GREEDYDATA:event}"]
    }
  }

```

This doesn't match on "openvpn[58567]" despite the pattern being valid.

I tried escaping the brackets without luck.

Would appreciate any help -- sure it'll be quick!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 3, 2018, 6:36am UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958/2 "2018-09-03T06:36:01Z")

</div>

```
if [prog] =~ /^openvpn\[[0-9]*\]$/ {

```

or

```
if [prog] =~ /^openvpn\[\d*\]$/ {
```

---

<div class="post-metadata">

**Author:** ![fishfox](https://avatars.discourse-cdn.com/v4/letter/f/bb73d2/32.png) [@fishfox](https://discuss.elastic.co/u/fishfox)\
**Post date:** [September 3, 2018, 7:50am UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958/3 "2018-09-03T07:50:58Z")

</div>

Thanks! I tried your first answer before and thought it didn't work -- it does.

Is there formal documentation as to which characters need special treatment in grok?

I did try to look so please forgive me if I missed something.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 3, 2018, 8:37am UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958/4 "2018-09-03T08:37:33Z")

</div>

> Is there formal documentation as to which characters need special treatment in grok?

Grok expressions are regular expressions with some extra %{PATTERN:fieldname} sugar on top so any regular expression reference will do.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2018, 8:37am UTC](https://discuss.elastic.co/t/working-with-brackets-in-regex/146958/5 "2018-10-01T08:37:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.