# Conditional grok
**URL:** https://discuss.elastic.co/t/conditional-grok/33641
**Category:** Logstash
**Created:** [November 3, 2015, 2:11pm UTC](https://discuss.elastic.co/t/conditional-grok/33641 "2015-11-03T14:11:21Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Tak\_MK](https://discuss.elastic.co/u/Tak_MK)
#### Post date: [November 3, 2015, 2:11pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/1 "2015-11-03T14:11:21Z")
Hi guys!
I have a log with two totally different patterns (yeah, I should split them up), and I want to parse them with grok.
Can I do something like "if the message has X word, use this grok pattern, else, use that pattern"?
Thanks a lot!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 3, 2015, 2:49pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/2 "2015-11-03T14:49:56Z")
You can either use regexp conditionals to choose between different filters (see the documentation for examples) or list multiple grok patterns that'll be applied in order with first-match-wins policy.
---
### Author:  [@Tak\_MK](https://discuss.elastic.co/u/Tak_MK)
#### Post date: [November 3, 2015, 2:56pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/3 "2015-11-03T14:56:15Z")
I'm reading this documentation page ([https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match)), but still don't know how to do it properly.
There's any other web with more information? If don't, can you put a simple example?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 3, 2015, 3:00pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/4 "2015-11-03T15:00:58Z")
In the grok documentation that you linked to, see the example preceded by "If you need to match multiple patterns against a single field, the value can be an array of patterns".
See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) for more on conditionals.
---
### Author:  [@Tak\_MK](https://discuss.elastic.co/u/Tak_MK)
#### Post date: [November 3, 2015, 3:57pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/5 "2015-11-03T15:57:37Z")
Thanks for the info!
I've tested if but it won't work (or I'm writing a wrong config file).
Here's my filter condition:
```
filter {
if [type] == "apache_access" {
grok {
patterns_dir => "./patterns"
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
}
else if [type] == "apache_error" {
if [message] in "ModSecurity" {
grok {
patterns_dir => "./patterns"
match => { "message" => "%{HTTPERRORDATE:date} \[%{HTTPMODULE:module}:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}\] \[client %{IP:IP}\] ModSecurity: %{GREEDYDATA:message}"}
}
} else {
grok {
patterns_dir => "./patterns"
match => { "message" => "%{HTTPERRORDATE:date} \[%{HTTPMODULE:module}:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}\] %{WORD:errorid}: %{GREEDYDATA:message}"}
}
}
}
else if [type] == "apache_request" {
grok {
patterns_dir => "./patterns"
match => { "message" => "\[%{HTTPDATE:date}\] %{IP:IP} %{WORDSPACE:cipher} %{WORDSPACE:encryption} \"%{WORD:action} %{WORDSPACE:message} %{WORDSPACE:http_protocol}\" %{GREEDYDATA}"}
}
}
}
```
I want to match if a line of a "apache\_error" type log has "ModSecurity" on it, and parse it with one grok or another.
The grok is running well (I've tested it on [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match) website), but I'm getting a lot of [0] "\_grokparsefailure".
Thanks a lot!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 3, 2015, 5:56pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/6 "2015-11-03T17:56:37Z")
> ```
> if [message] in "ModSecurity" {
>
> ```
This is backwards, change to:
```
if "ModSecurity" in [message] {
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 3, 2015, 5:58pm UTC](https://discuss.elastic.co/t/conditional-grok/33641/7 "2015-11-03T17:58:24Z")
Also, I wouldn't assume anything about what the current directory is. I suggest you specify absolute paths to the pattern file directory.
---
### Author:  [@Tak\_MK](https://discuss.elastic.co/u/Tak_MK)
#### Post date: [November 4, 2015, 8:40am UTC](https://discuss.elastic.co/t/conditional-grok/33641/8 "2015-11-04T08:40:40Z")
I'll try that, and change the patterns path. Thanks a lot for your help!
EDIT: It works, thanks! 😃
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/conditional-grok/33641/9 "2017-07-06T05:24:08Z")