# Filebeat: Check if a String Starts With Number Using Regular Expression

To check if a string starts with a number using Filebeat and regular expressions, you can use the `processors` configuration in Filebeat. Specifically, you’ll use the `grok` processor to match patterns in your log lines.

Here's an example of how to configure Filebeat to check if a string starts with a number:

1. **Add the `grok` processor to your Filebeat configuration:**
    
    ```yaml
    processors:
      - grok:
          patterns:
            - '^(?<number_start>\\d)'
    ```
    
    In this configuration:
    
    - `^(?<number_start>\\d)` is a regular expression where `^` asserts the position at the start of the string, and `\\d` matches any digit. `(?<number_start>\\d)` captures the digit in a named group `number_start`.
2. **Use the extracted data:**
    
    You can use the extracted `number_start` field to filter or manipulate logs based on whether they start with a number.
    

Here's a more complete example for a typical Filebeat configuration file:

```yaml
filebeat.inputs:
  - type: log
    paths:
      - /var/log/myapp/*.log

processors:
  - grok:
      patterns:
        - '^(?<number_start>\\d)'
  - drop_fields:
      when:
        not:
          has_fields: ['number_start']
```

In this example:

- The `grok` processor checks if the log lines start with a number and captures it.
- The `drop_fields` processor drops the event if it doesn’t have the `number_start` field, effectively filtering out log lines that don’t start with a number.

Make sure to adjust the paths and patterns according to your specific use case.