In logstash filtering, I have multiple tags setup based upon different error conditions and all the tags has a prefix, something like "abc:"

In the output, I want to send email based upon just "abc:*" exists in tags.

I haven't come across such condition reading the docs.

Mostly it says:

if "abc" in [tags] { ... ... }

However I want to have the condition match any tag with "abc-*". Any ideas?


Are you looking for this (here in perl syntax)?


If abc is a word you can use \w instead of [^\"].

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.