Negative regexp in logstash configuration

Question

I cannot get negative regexp expressions working within LogStash (as described in the docs)

Consider the following positive regex which works correctly to detect fields that have been assigned a value:

if [remote_ip] =~ /(.+)/ {
    mutate { add_tag => ["ip"] }
}

However, the negative expression seems to return false even when the field is blank:

if [remote_ip] !~ /(.+)/ {
    mutate { add_tag => ["no_ip"] }
}

Am I misunderstanding the usage?

Update - this was fuzzy thinking on my part. There were issues with my config file. If the rest of your config file is sane, the above should work.

Answer 1

This was fuzzy thinking on my part - there were issues with the rest of my config file.

Based on Ben Lim's example, I came up with an input that is easier to test:

input {
    stdin { }
}

filter {
    if [message] !~ /(.+)/ {
         mutate { add_tag => ["blank_message"] }
    }
    if [noexist] !~ /(.+)/ {
         mutate { add_tag => ["tag_does_not_exist"] }
    }
}

output {
    stdout {debug => true}
}

The output for a blank message is:

{
       "message" => "",
      "@version" => "1",
    "@timestamp" => "2014-02-27T01:33:19.285Z",
          "host" => "benchmark.example.com",
          "tags" => [
        [0] "blank_message",
        [1] "tag_does_not_exist"
    ]
}

The output for a message with the content "test message" is:

test message
{
       "message" => "test message",
      "@version" => "1",
    "@timestamp" => "2014-02-27T01:33:25.059Z",
          "host" => "benchmark.example.com",
          "tags" => [
        [0] "tag_does_not_exist"
    ]
}

Thus, the "negative regex" /(.+)/ returns true only when the field is empty or the field does not exist.

The negative regex /(.*)/ will only return true when the field does not exist. If the field exists (whether empty or with values), the return value will be false.

Answer 2

Below is my configuration. The type field is not exist, therefore, the negative expression is return true.

input {
    stdin {
    }
}

filter {
    if [type] !~ /(.+)/ {
         mutate { add_tag => ["aa"] }
    }
}

output {
    stdout {debug => true}
}

The regexp /(.+)/ means it accepts everything, include blank. So, when the "type" field is exist, even the field value is blank, it also meet the regexp. Therefore, in your example, if the remote_ip field exist, your "negative expression" will always return false.