# Error in multiple match in logstash filter

**URL:** <https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800>\
**Category:** Logstash\
**Created:** [February 14, 2018, 1:20pm UTC](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800 "2018-02-14T13:20:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Laxman](https://avatars.discourse-cdn.com/v4/letter/l/db5fbb/32.png) [@Laxman](https://discuss.elastic.co/u/Laxman)\
**Post date:** [February 14, 2018, 1:20pm UTC](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800/1 "2018-02-14T13:20:21Z")

</div>

I'm parsing an Execution log and trying to assign different types based on which type of log entry a given line is. Facing Error while execution. not sure what is the issue in filter, can anyone help me on this

filter {  
grok {  
break\_on\_match =\> false  
match =\> {"message" =\> "[%{TIMESTAMP\_ISO8601:rundeck\_ex\_timestamp}] %{USERNAME:rundeck\_ex\_user} %{WORD:rundeck\_ex\_action} [%{NUMBER:rundeck\_ex\_id:int}:%{WORD:rundeck\_ex\_return}] %{DATA:rundeck\_ex\_project} %{USERNAME:rundeck\_ex\_user}/- \"%{DATA:rundeck\_ex\_jobname}\"[%{DATA:rundeck\_ex\_jobid}]"}  
match =\> {"message" =\> "[%{TIMESTAMP\_ISO8601:rundeck\_ex\_timestamp}] %{USERNAME:rundeck\_ex\_user} %{WORD:rundeck\_ex\_action} [%{NUMBER:rundeck\_ex\_id:int}:%{WORD:rundeck\_ex\_return}] %{DATA:rundeck\_ex\_project} %{USERNAME:rundeck\_ex\_user}/- "%{DATA:rundeck\_ex\_jobname}"[%{DATA:rundeck\_ex\_jobid}]"}  
remove\_field =\> ["message"]  
}

if "\_grokparsefailure" in [tags] {  
drop {}  
}  
}

Failed to execute action {:id=\>:Rundeck, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Expected one of #, {, } at line 12, column 253 (byte 700) after filter {\r\n grok {\r\n break\_on\_match =\> false\r\n match =\> {"message" =\> "\[%{TIMESTAMP\_ISO8601:rundeck\_ex\_timestamp}\] %{USERNAME:rundeck\_ex\_user} %{WORD:rundeck\_ex\_action} \[%{NUMBER:rundeck\_ex\_id:int}:%{WORD:rundeck\_ex\_return}\] %{DATA:rundeck\_ex\_project} %{USERNAME:rundeck\_ex\_user}/- \\"%{DATA:rundeck\_ex\_jobname}\\"\[%{DATA:rundeck\_ex\_jobid}\]"}\r\n match =\> {"message" =\> "\[%{TIMESTAMP\_ISO8601:rundeck\_ex\_timestamp}\] %{USERNAME:rundeck\_ex\_user} %{WORD:rundeck\_ex\_action} \[%{NUMBER:rundeck\_ex\_id:int}:%{WORD:rundeck\_ex\_return}\] %{DATA:rundeck\_ex\_project} %{USERNAME:rundeck\_ex\_user}/- "", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/reload.rb:34:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:335:in`block in converge\_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:332:in`block in converge\_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:319:in`converge\_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in`with\_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:105:in`block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/interval.rb:18:in `interval'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:343:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in`block in initialize'"]}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 14, 2018, 1:31pm UTC](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800/2 "2018-02-14T13:31:51Z")

</div>

You can't have double quotes inside your grok expression if you use double quotes to delimit the expression itself. Use single quotes around your expression instead.

(Side note: Avoid multiple DATA or GREEDYDATA patterns in the same expression. Use more exact patterns instead, perhaps NOTSPACE in this case.)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 14, 2018, 2:14pm UTC](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800/3 "2018-02-14T14:14:25Z")

</div>

Also, there are two match =\> statements. And you need to escape square brackets in the grok expression. Try this...

```
match => {"message" => '\[%{TIMESTAMP_ISO8601:rundeck_ex_timestamp}\] %{USERNAME:rundeck_ex_user} %{WORD:rundeck_ex_action} \[%{NUMBER:rundeck_ex_id:int}:%{WORD:rundeck_ex_return}\] %{DATA:rundeck_ex_project} %{USERNAME:rundeck_ex_user}/- "%{DATA:rundeck_ex_jobname}"\[%{DATA:rundeck_ex_jobid}\]'}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2018, 2:14pm UTC](https://discuss.elastic.co/t/error-in-multiple-match-in-logstash-filter/119800/4 "2018-03-14T14:14:38Z")

</div>

Closed on March 14, 2018, 2:14pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.