# Drop all grok matches **URL:** \ **Category:** Logstash\ **Created:** [August 17, 2017, 10:32am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391 "2017-08-17T10:32:53Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![sentinel](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Post date:** [August 17, 2017, 10:32am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/1 "2017-08-17T10:32:53Z")
I want to obliterate everything this grok filter matches unconditionally is there a simple way? There are a lot of combinations so it's better if mated by grok otherwise I will be declaring a lot of conditions. Unless of course there's a simple condition that can catch all of them. This is what I tried and it doesn't work grok { match =\> { "stacktraces" =\> "^(?[\w\d:-.()\ $[?]]+)" } drop { } } } } ---
**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Post date:** [August 17, 2017, 11:13am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/2 "2017-08-17T11:13:02Z")
you can us add\_tag =\> "drop" on the grok filter and than souround the drop with an if that checks for this tag ``` grok { match => { “stacktraces” => “^(?[\w\d:-.()\ $[?]]+)” } add_tag => ["drop"] } if "drop" in [tags] { drop { } } ``` ---
**Author:** ![sentinel](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Post date:** [August 17, 2017, 11:22am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/3 "2017-08-17T11:22:01Z")
> [@Shaoranlaos](#): > > grok { > match =\> { > “stacktraces” =\> “^(?[\w\d:-.()\ $[?]]+)” > } > add\_tag =\> ["drop"] > } > if "drop" in [tags] { > drop { } > } reason=\>"Expected one of #, input, filter, output at line 25, column 1 (byte 637) after ", :level=\>:error, :file=\>"logstash/agent.rb", :line=\>"448", :method=\>"create\_pipeline"} ---
**Author:** ![sentinel](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Post date:** [August 17, 2017, 11:22am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/4 "2017-08-17T11:22:34Z")
I'm I missing something here? ---
**Author:** ![sentinel](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Post date:** [August 17, 2017, 11:24am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/5 "2017-08-17T11:24:16Z")
Gotcha ... it was supposed to be in the filter. Working now ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 17, 2017, 11:58am UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/6 "2017-08-17T11:58:48Z")
You don't need a grok filter, just wrap a drop filter in a conditional. [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#conditionals) ---
**Author:** ![sentinel](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Post date:** [August 17, 2017, 1:27pm UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/7 "2017-08-17T13:27:56Z")
Magnus How do I describe the lines because they haven't been through main filters yet. They are stacktrace lines I'm trying to get rid of. What's the best way of describing them so it's dropped before the main filter kicks in. At this point there are no fields. I can't use if [blah] in "message" there's no message field yet. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 17, 2017, 2:01pm UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/8 "2017-08-17T14:01:20Z")
Well, what _is_ in the message then? ---
**Author:** ![sentinel](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Post date:** [August 17, 2017, 2:12pm UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/9 "2017-08-17T14:12:22Z")
``` at ac.com.xxx.etrading.xxxxx.pfserver.services.PriceRequestListener.handlePriceRequest(PriceRequestListener.java:117) [pfserver-2.20.3.jar:?] at ac.com.xxx.etrading.xxxxx.pfserver.services.PriceRequestListener.onMessage(PriceRequestListener.java:204) [pfserver-2.20.3.jar:?] at ac.com.xxx.etrading.xxxxx.pfserver.services.PriceRequestListener.onMessage(PriceRequestListener.java:23) [pfserver-2.20.3.jar:?] at ac.com.xxx.etrading.xxxxx.messaging.tum.AbstractTumProtoSubscriber$TumProtoEventListener.go(AbstractTumProtoSubscriber.java:66) [xxxxx-messaging-tum-1.0.21.jar:?] ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 17, 2017, 7:38pm UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/10 "2017-08-17T19:38:44Z")
Is this an example of four lines of input or have you joined the lines into a single event? We can save some time if you give more details. Seeing exactly what an event looks like is a good start. Use a `stdout { codec => rubydebug }` output to get the raw event. And why would you want to drop these lines? Anyway, if they enter Logstash at all they are stored in a field and then you can use a conditional to drop them. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2017, 7:38pm UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391/11 "2017-09-14T19:38:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.