Search code examples
regexlogstashlogstash-grok

match fields in logstash with "$"

I want to match specific fields if they contain the symbol "$"

Data Sample :

"SubjectUserName": "HOSTNAME$"

logstash Config:

if [SubjectUserName] =~ [A-Z]+\$ {
#do stuff

thanks for your help

Solution

  • Let's start from your example: if [SubjectUserName] =~ [A-Z]+\$ {.

    It actually means: Check whether somewhere in SubjectUserName occurs:

    • [A-Z]+ - a non-empty sequence of letters,
    • \$ - and then a dollar char.

    Both before and after this match there can occur any other text.

    So if you want only to check for presence of a dollar char, somewhere in the mentioned field, the regex should probably be:

    if [SubjectUserName] =~ \$ {