Negative regexp in logstash configuration

logstash

Solution

This was fuzzy thinking on my part - there were issues with the rest of my config file.

Based on Ben Lim's example, I came up with an input that is easier to test:

input {
    stdin { }
}

filter {
    if [message] !~ /(.+)/ {
         mutate { add_tag => ["blank_message"] }
    }
    if [noexist] !~ /(.+)/ {
         mutate { add_tag => ["tag_does_not_exist"] }
    }
}

output {
    stdout {debug => true}
}

The output for a blank message is:

{
       "message" => "",
      "@version" => "1",
    "@timestamp" => "2014-02-27T01:33:19.285Z",
          "host" => "benchmark.example.com",
          "tags" => [
        [0] "blank_message",
        [1] "tag_does_not_exist"
    ]
}

The output for a message with the content "test message" is:

test message
{
       "message" => "test message",
      "@version" => "1",
    "@timestamp" => "2014-02-27T01:33:25.059Z",
          "host" => "benchmark.example.com",
          "tags" => [
        [0] "tag_does_not_exist"
    ]
}

Thus, the "negative regex" `/(.+)/` returns true only when the field is empty or the field does not exist.

The negative regex `/(.*)/` will only return true when the field does not exist. If the field exists (whether empty or with values), the return value will be false.

Problem

I cannot get negative regexp expressions working within LogStash (as described in the docs) Consider the following positive regex which works correctly to detect fields that have been assigned a value: ``` if [remote_ip] =~ /(.+)/ { mutate { add_tag => ["ip"] } } ``` However, the negative expression seems to return false even when the field is blank: ``` if [remote_ip] !~ /(.+)/ { mutate { add_tag => ["no_ip"] } } ``` Am I misunderstanding the usage? Update - this was fuzzy thinking on my part. There were issues with my config file. If the rest of your config file is sane, the above should work.

Original source