# Custom pattern problems in the grok filter

**URL:** https://discuss.elastic.co/t/custom-pattern-problems-in-the-grok-filter/26221
**Category:** Logstash
**Created:** [July 24, 2015, 8:41am UTC](https://discuss.elastic.co/t/custom-pattern-problems-in-the-grok-filter/26221 "2015-07-24T08:41:36Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![simonrisberg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simonrisberg/32/3513_2.png) [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 24, 2015, 8:41am UTC](https://discuss.elastic.co/t/custom-pattern-problems-in-the-grok-filter/26221/1 "2015-07-24T08:41:36Z")

</div>

Hi!

I'm currently using two different custom patterns that I've made in my logstash config. One pattern serves the purpose of filter a certain word in a filepath in the event message in every log and take out that particular word and turn it into a field. The other custom pattern serves the purpose of creating an own timestamp based on the date stated in every event in the log file and then populate the standard @timestamp field.

This works partly although the second custom pattern doesn't care about the events where the particular word from the first custom patterns exist. So to clear this out. Where the first custom pattern is a match logstash automatically skips the second pattern. How do I fix this? Down below you'll find my logstash configuration file.

```
    input {
  syslog {
    port => 5514
    codec => "json"
  }
  file {
    path => "/var/externallogs_maven/data"
    type => "nexus-log"
    start_position => "beginning"
  }
}
filter {

   grok {

     type => "nexus-log"

     match => [
        "message", "\b\w+\b\s/nexus/content/repositories/(?<repositories>[^/]+)",
        "message", "(?<mytimestamp>%{MONTHDAY}/%{MONTH}/%{YEAR}:%{HOUR}:%{MINUTE}:%{SECOND} %{ISO8601_TIMEZONE})"

      ]
   }
   date{
      match => ["mytimestamp", "dd/MMM/YYYY:HH:mm:ss Z"]

   }

}
output {

  elasticsearch{
    host => es
    port => 9300
    cluster => "elkjepp"
    protocol => "transport"
 }
 stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 24, 2015, 8:14pm UTC](https://discuss.elastic.co/t/custom-pattern-problems-in-the-grok-filter/26221/2 "2015-07-24T20:14:00Z")

</div>

For the record, this was sorted out here:

> [@Get the right timestamp for old log files](https://discuss.elastic.co/t/get-the-right-timestamp-for-old-log-files/24943/57):
>
> Okay. You have a single grok filter with multiple expressions. With the default true value of [break\_on\_match](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-break_on_match) grok will stop once it gets a match. You need to disable that or split your multi-expression grok filter into two separate filters.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/custom-pattern-problems-in-the-grok-filter/26221/3 "2017-07-06T05:33:51Z")

</div>