Geek asks and answers

Negative regex in logstash configuration

I cannot get expressions with regexp expression working in LogStash (as described in docs )

Consider the following positive regular expression that works correctly to detect fields that are assigned a value:

if [remote_ip] =~ /(.+)/ {
    mutate { add_tag => ["ip"] }
}

However, a negative expression returns false, even if the field is empty:

if [remote_ip] !~ /(.+)/ {
    mutate { add_tag => ["no_ip"] }
}

Am I misunderstanding the use?

Update - it was fuzzy thinking on my part. There were problems with my configuration file. If the rest of your config file is normal, the above should work.

+3
source share
2 answers

- .

, , :

input {
    stdin { }
}

filter {
    if [message] !~ /(.+)/ {
         mutate { add_tag => ["blank_message"] }
    }
    if [noexist] !~ /(.+)/ {
         mutate { add_tag => ["tag_does_not_exist"] }
    }
}

output {
    stdout {debug => true}
}

:

{
       "message" => "",
      "@version" => "1",
    "@timestamp" => "2014-02-27T01:33:19.285Z",
          "host" => "benchmark.example.com",
          "tags" => [
        [0] "blank_message",
        [1] "tag_does_not_exist"
    ]
}

:

test message
{
       "message" => "test message",
      "@version" => "1",
    "@timestamp" => "2014-02-27T01:33:25.059Z",
          "host" => "benchmark.example.com",
          "tags" => [
        [0] "tag_does_not_exist"
    ]
}

, " " /(.+)/ true , .

/(.*)/ true , . ( ), .

+1

. , true.

input {
    stdin {
    }
}

filter {
    if [type] !~ /(.+)/ {
         mutate { add_tag => ["aa"] }
    }
}

output {
    stdout {debug => true}
}

/(. +)/ , , . , "type" , , . , remote_ip , " " false.

+1

More articles:


All Articles