# ES grok processor break\_on\_match =\> false needed

**URL:** https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697
**Category:** Elasticsearch
**Created:** [August 11, 2017, 4:10am UTC](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697 "2017-08-11T04:10:48Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ffoysal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ffoysal/32/21037_2.png) [@ffoysal](https://discuss.elastic.co/u/ffoysal)
#### Post date: [August 11, 2017, 4:10am UTC](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697/1 "2017-08-11T04:10:48Z")

</div>

We have a pattern in logstash grok filter like this  
grok {  
break\_on\_match =\> false  
match =\> ["message",".+mv=(?\<mediaVendor\>[\w]+)[\s&]+.+",  
"message",".+mf=(?\<mediaFolder\>[\w]+)[\s&]+.+",  
"message",".+cmd=(?\<command\>[\w]+).+"]  
}

we have three different combinations of logs in the same logfile.

Now we are trying to use elasticsearch pipeline facility with grok processor. But in the pipeline grok processor we can list multiple patterns but only first match returns. What should be the best way to achieve the same functionality. Help is greatly appreciated.

Thanks  
Foysal

---

<div class="post-metadata">

### Author: ![talevy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talevy/32/44896_2.png) [@talevy](https://discuss.elastic.co/u/talevy)
#### Post date: [August 18, 2017, 7:25pm UTC](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697/2 "2017-08-18T19:25:37Z")

</div>

You're absolutely right that this feature does not exist. Ingest, in effect, has `break_on_match => true` by default.

If all can potentially match, maybe split them up in separate grok processors? so that they are all applied

let me know if that would result in the behavior you're looking for

---

<div class="post-metadata">

### Author: ![mytzusky](https://avatars.discourse-cdn.com/v4/letter/m/ed8c4c/32.png) [@mytzusky](https://discuss.elastic.co/u/mytzusky)
#### Post date: [August 22, 2017, 2:04pm UTC](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697/3 "2017-08-22T14:04:13Z")

</div>

**Was just about to ask the same thing, any plans on including this option in the Grok processor ?**

Also, for wiki, a possible solution I've used is to wrap each pattern in a **( )**\* so it ignores missing matches, in his example:

```
{
        "grok": {
            "field": "message",
            "patterns": ["%{VENDOR}%{FOLDER}%{COMMAND}"],
            "pattern_definitions" : {
                "VENDOR" : "(.+mv=(?<mediaVendor>[\w]+)[\s&]+.+)*",
                "FOLDER" : "(.+mf=(?<mediaFolder>[\w]+)[\s&]+.+)*",
                "COMMAND" : "(.+cmd=(?<command>[\w]+).+)*"
            },
            "ignore_failure": true
        }
    },

```

I'm not sure what's the performance compared to having different grok processors but it works.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 19, 2017, 2:04pm UTC](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697/4 "2017-09-19T14:04:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.