# Filter for When Log changes Slightly

**URL:** <https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152>\
**Category:** Logstash\
**Created:** [March 24, 2021, 1:07am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152 "2021-03-24T01:07:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rmoss25](https://avatars.discourse-cdn.com/v4/letter/r/b4bc9f/32.png) [@rmoss25](https://discuss.elastic.co/u/rmoss25)\
**Post date:** [March 24, 2021, 1:07am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152/1 "2021-03-24T01:07:17Z")

</div>

HI,  
How do you create a grok pattern that can handle the log changing every now and then so I have a filter written that works but every so often the last field of an almost identical log is empty and the existing filter cant handle it.  
e.g Logs

"MAR-21 00:43:38|158.98.214.94|2|CN=Test.Test,OU=alpha Users,OU=alpha,OU=Test Units,DC=alphadev,DC=dev,DC=abc,DC=ca|foJ16BD1/B42LI5Cfke/D4oDcUA=|ABCDEF"

"12-MAR-21 07:50:06|10.82.96.130|10|CN=ez91288,OU=BEV Users,OU=BEV,OU=Business Units,DC=alpha,DC=corp,DC=abc,DC=ca|+uOdgwg5RbNyjjd8JYBtk2K6yH8=|"

so the 2nd log doesn't have the field "|ABCDEF" so it breaks parsing.

```auto
%{GREEDYDATA:timestamp}\|%{IPV4:src_ip}\|%{WORD:event_id}\|%{GREEDYDATA:DN}\|%{NOTSPACE:session}\|%{NOTSPACE:application} | 

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2021, 2:40am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152/2 "2021-03-24T02:40:27Z")

</div>

If a grok field is optional then you can surround it with `()?` (i.e. zero or more of the capture group) to tell grok that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2021, 2:41am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152/3 "2021-04-21T02:41:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.