# Grok add\_tag processed when no match was found

**URL:** <https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304>\
**Category:** Logstash\
**Created:** [March 19, 2020, 7:46pm UTC](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304 "2020-03-19T19:46:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elady](https://avatars.discourse-cdn.com/v4/letter/e/82dd89/32.png) [@elady](https://discuss.elastic.co/u/elady)\
**Post date:** [March 19, 2020, 7:46pm UTC](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304/1 "2020-03-19T19:46:07Z")

</div>

Hey.  
I have the following configuration:

```
filter {
	grok {
		match => {
			"message" => "%{TIMESTAMP_ISO8601:event_timestamp}%{SPACE}%{DATA:log_level}%{SPACE}\[%{DATA:host}\]%{SPACE}\[%{DATA:tenant}\]%{SPACE}\[%{DATA:java_class}\]%{SPACE}-%{SPACE}<SchedulerTaskRunLog \[jobName=%{DATA:task}, tenantId=%{DATA:tenant}, startTime=%{TIMESTAMP_ISO8601:task_start_time}, endTime=%{TIMESTAMP_ISO8601:task_end_time}, status=%{DATA:status}, description=%{GREEDYDATA:text}\]>"
			"path" => "%{GREEDYDATA:filename}"
		}
		add_tag => ["scheduled_task1", "processed"]
	}

```

The problem is that the tags are being added even if there was no match.  
I know there was no match because I take the event message from Kibana and uses the grok debugger with the same grok pattern and get an error.  
Also, I don't see any of my parsed fields in the event.  
Another thing is that according to the Kibana 100% of the events have the "scheduled\_task1" tag. this is bad...

I will very much appreciate any ideas.  
Thank you!

---

<div class="post-metadata">

**Author:** ![rcowart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rcowart/32/88091_2.png) [@rcowart](https://discuss.elastic.co/u/rcowart)\
**Post date:** [March 20, 2020, 6:10pm UTC](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304/2 "2020-03-20T18:10:33Z")

</div>

Since you are using only `GREEDYDATA` against the `path` field, it will always match. I would remove that from the grok filter, and set `filename` using a `mutate` filter.

Rob

[![GitHub](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f8ae834f16b1a02d31607317669716807844d84.png)](https://github.com/robcowart) [![YouTube](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43b9b81a8c93786219985aeb5335c1c323449053.png)](https://www.youtube.com/channel/UCivWvTx1DwrWNcDLV58kmOg) [![LinkedIn](https://us1.discourse-cdn.com/elastic/original/3X/6/7/674f3370d0f0542ddc5e408516beb1b7edd6c1bf.png)](https://www.linkedin.com/in/robertcowart/)  
**[How to install Elasticsearch & Kibana on Ubuntu - incl. hardware recommendations](https://www.youtube.com/watch?v=gZb7HpVOges)**  
**[What is the best storage technology for Elasticsearch?](https://www.youtube.com/watch?v=nKUpfJCBiS4)**

---

<div class="post-metadata">

**Author:** ![elady](https://avatars.discourse-cdn.com/v4/letter/e/82dd89/32.png) [@elady](https://discuss.elastic.co/u/elady)\
**Post date:** [March 22, 2020, 10:39am UTC](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304/3 "2020-03-22T10:39:39Z")

</div>

That was a good and elegant idea.  
I have tried it but found out that my `path` field was then duplicated.  
Apparently the `path` field is being populated in the `input` section, so I ended up removing the entire thing altogether and now it works.

Thank you very much for your quick respond, I feel like my configuration is much better now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2020, 10:39am UTC](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304/4 "2020-04-19T10:39:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.