# Break\_on\_match not working
**URL:** https://discuss.elastic.co/t/break-on-match-not-working/184715
**Category:** Logstash
**Created:** [June 7, 2019, 8:48am UTC](https://discuss.elastic.co/t/break-on-match-not-working/184715 "2019-06-07T08:48:03Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Hyllegaard](https://discuss.elastic.co/u/Hyllegaard)
#### Post date: [June 7, 2019, 8:48am UTC](https://discuss.elastic.co/t/break-on-match-not-working/184715/1 "2019-06-07T08:48:03Z")
After upgrading to 7.1.0, the logic seems to have changed.
I used to have this grok:
grok {
match =\> { "message" =\> "webapp=%{URIPATH:webapp} path=%{URIPATH:path} params={%{GREEDYDATA:Params}} hits=%{BASE10NUM:hits} status=%{BASE10NUM:status} QTime=%{BASE10NUM:QTime2:int}" }
match =\> { "message" =\> "webapp=%{DATA:webapp} path=%{URIPATH:path} params={%{GREEDYDATA:Params}} status=%{BASE10NUM:status} QTime=%{BASE10NUM:QTime2:int}" }
match =\> { "message" =\> "%{GREEDYDATA}" }
}
So that if none of the first two worked it would grok the last one.
However after the upgrade, only the last match is invoked. I have tried moving the "greedy" one to the top of the list and then one of the two other match-lines are used correctly.
I have tried adding the break\_on\_match =\> true line, but that does not seem to do anything.
Can anyone verify this?
Regards
Jens Hyllegaard
---
### Author:  [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)
#### Post date: [June 7, 2019, 9:19am UTC](https://discuss.elastic.co/t/break-on-match-not-working/184715/2 "2019-06-07T09:19:47Z")
the configuration is a bit strange... Could you try:
```auto
grok {
match => { "message" => [
"webapp=%{URIPATH:webapp} path=%{URIPATH:path} params={%{GREEDYDATA:Params}} hits=%{BASE10NUM:hits} status=%{BASE10NUM:status} QTime=%{BASE10NUM:QTime2:int}",
"webapp=%{DATA:webapp} path=%{URIPATH:path} params={%{GREEDYDATA:Params}} status=%{BASE10NUM:status} QTime=%{BASE10NUM:QTime2:int}",
"%{GREEDYDATA}"
]
}
}
```
---
### Author:  [@Hyllegaard](https://discuss.elastic.co/u/Hyllegaard)
#### Post date: [June 7, 2019, 9:56am UTC](https://discuss.elastic.co/t/break-on-match-not-working/184715/3 "2019-06-07T09:56:44Z")
I tried copying your example but it generated the following error:
```
[2019-06-07T09:50:17,595][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of #, => at line 20, column 11 (byte 694) after filter {\n\tif [type] == \"syslog\" {\n\t\tif [logsource] in [\"solr1\", \"SOLR1\", \"solr2\", \"SOLR2\", \"solr3\", \"SOLR3\", \"solrudv\", \"SOLRUDV\", \"solrtst\", \"SOLRTST\"] {\n\t\t\tgrok { \n\t\t\t break_on_match => true\n\t\t\t match => { \"message\" => [\n\t\t \"webapp=%{URIPATH:webapp} path=%{URIPATH:path} params={%{GREEDYDATA:Params}} hits=%{BASE10NUM:hits} status=%{BASE10NUM:status} QTime=%{BASE10NUM:QTime2:int}\",\n\t\t \"webapp=%{DATA:webapp} path=%{URIPATH:path} params={%{GREEDYDATA:Params}} status=%{BASE10NUM:status} QTime=%{BASE10NUM:QTime2:int}\",\n\t\t \"%{GREEDYDATA}\"\n\t\t]\n\t\t\t}\n\n\t\t\tmutate ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:37:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
```
I tried checking the formatting, but I was unable to make it work.
Also my own configuration was valid in 6.6?
---
### Author:  [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)
#### Post date: [June 7, 2019, 10:49am UTC](https://discuss.elastic.co/t/break-on-match-not-working/184715/4 "2019-06-07T10:49:12Z")
I think you forgot to copy the last } in my Code example. There are two } at the end.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2019, 10:49am UTC](https://discuss.elastic.co/t/break-on-match-not-working/184715/5 "2019-07-05T10:49:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.