Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Logstash if statement with regex example

Tags:

regex

logstash

Can anyone show me what an if statement with a regex looks like in logstash?

My attempts:

if [fieldname] =~ /^[0-9]*$/

if [fieldname] =~ "^[0-9]*$"

Neither of which work.

What I intend to do is to check if the "fieldname" contains an integer

like image 260
Shawn Sim Avatar asked Feb 20 '17 10:02

Shawn Sim


2 Answers

To combine the other answers into a cohesive answer.

Your first format looks correct, but your regex is not doing what you want.

/^[0-9]*$/ matches:

^: the beginning of the line

[0-9]*: any digit 0 or more times

$: the end of the line

So your regex captures lines that are exclusively made up of digits. To match on the field simply containing one or more digits somewhere try using /[0-9]+/ or /\d+/ which are equivalent and each match 1 or more digits regardless of the rest of the line.

In total you should have:

if [fieldname] =~ /\d+/ {
   # do stuff
}
like image 75
Will Barnwell Avatar answered Sep 23 '22 17:09

Will Barnwell


The simplest way is to check for \d

if [fieldname] =~ /\d+/ {
   ...
}
like image 43
Val Avatar answered Sep 21 '22 17:09

Val