# Define second pattern for the remaining logs
**URL:** https://discuss.elastic.co/t/define-second-pattern-for-the-remaining-logs/346010
**Category:** Kibana
**Created:** [October 30, 2023, 8:28am UTC](https://discuss.elastic.co/t/define-second-pattern-for-the-remaining-logs/346010 "2023-10-30T08:28:59Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@hta](https://discuss.elastic.co/u/hta)
#### Post date: [October 30, 2023, 8:28am UTC](https://discuss.elastic.co/t/define-second-pattern-for-the-remaining-logs/346010/1 "2023-10-30T08:28:59Z")
Hello, I have now set up a pipeline and defined a GROK pattern. It is working. However, the logs that do not match the pattern are not displayed. How could I define a simple second pattern to catch the remaining logs?
---
### Author:  [@Anton\_H](https://discuss.elastic.co/u/Anton_H)
#### Post date: [October 31, 2023, 3:27pm UTC](https://discuss.elastic.co/t/define-second-pattern-for-the-remaining-logs/346010/2 "2023-10-31T15:27:00Z")
Hello hta,
You could add a `%{GREEDYDATA:data}` after your own Grok pattern. This should catch all.
Example:
```auto
"patterns": [
"User %{USERNAME:user.name} %{GREEDYDATA:event.action} via %{WORD:ui} from %{IP:source.ip} using %{WORD:event.provider}",
"User %{USERNAME:user.name} %{GREEDYDATA:event.action} via %{WORD:ui} from %{IP:source.ip}",
"User %{USERNAME:user.name} %{GREEDYDATA:event.action}",
"%{GREEDYDATA:data}"
]
```
The first three would extract data from events and map that to specific fields. The fourth entry is the catchall and maps it to the "data" field.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 28, 2023, 3:27pm UTC](https://discuss.elastic.co/t/define-second-pattern-for-the-remaining-logs/346010/3 "2023-11-28T15:27:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.