Can I do an or in a match

Elastic Stack Logstash
1

Is there a way I can write a grok to do something like:

grok{
    match => [ "Message_Data", "File \"C:\\\\Windows\\Prefetch\\DLL" or "New File \"C:\\\\Windows\\Prefetch\\DLL " ]

I don't want to have to write to separate statements for this match since i would just be duplicating everything

2

Use | to separate the different options (often combined with parentheses):

(some-subexpression|another-subexpression|...)