# \[Grok\] Array of patterns - only first pattern matched

**URL:** <https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234>\
**Category:** Logstash\
**Created:** [November 21, 2020, 4:34pm UTC](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234 "2020-11-21T16:34:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![james64](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james64/32/79449_2.png) [@james64](https://discuss.elastic.co/u/james64)\
**Post date:** [November 21, 2020, 4:34pm UTC](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234/1 "2020-11-21T16:34:52Z")

</div>

Hello,

based on [this](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match) documentation I am trying to use grok filter with this configuration:

```auto
        grok {
          match => {
            "message" => [
              ' volume_path="%{UNIXPATH:csi_volume_path}',
              ' msg="(?<csi_msg>[^"]*)"',
              ' volume_id=%{UUID:csi_volume_id}',
              ' host_id=%{NUMBER:csi_host_id}',
              ' cmd=%{WORD:csi_cmd}',
              ' args="[(?<csi_cmd_args>[^"]*)]"'
            ]
          }
        }

```

Here is example `message`:

```auto
time="2020-11-21T15:17:17Z" level=info msg="node get volume stats called" host_id=209881301 method=node_get_volume_stats region=fra1 version=latest volume_id=bafcd0ac-1dbe-11eb-bac9-0a58ac14d147 volume_path="/var/lib/kubelet/pods/bf7f9cdd-d0c0-4b7f-bffb-76e38a590cae/volumes/kubernetes.io~csi/pvc-b4255b85-64c3-47cc-a62c-612164b0eef4/mount"

```

My log messages matches more then one of these patterns (checked on [grokdebug.herokuapp.com](http://grokdebug.herokuapp.com)). However in document in elastic I can only see result from first pattern (as listed in config). I tried to reorder the patterns in array and restart Logstash. I can see other fields that way. But never more then first one.

Do I miss something or is this a bug? Is there any other way I can match multiple patterns on single field?

Version I use is `docker.elastic.co/logstash/logstash:7.9.3`

Happy to provide further info. Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 21, 2020, 4:45pm UTC](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234/2 "2020-11-21T16:45:24Z")

</div>

Set the [break\_on\_match](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-break_on_match) option on the grok filter to false if you want it to try all of the patterns.

But why not use a [kv](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) filter?

---

<div class="post-metadata">

**Author:** ![james64](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james64/32/79449_2.png) [@james64](https://discuss.elastic.co/u/james64)\
**Post date:** [November 21, 2020, 5:19pm UTC](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234/3 "2020-11-21T17:19:21Z")

</div>

Oh that makes sense thanks!

Yes kv filter would make more sense here. I am trying to use grok because I was tasked with (finding my own sample data and) learning grok filter. It's part of mentoring program. I was simply too lazy to find/make up log data better suitable for grok so here I am...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2020, 5:19pm UTC](https://discuss.elastic.co/t/grok-array-of-patterns-only-first-pattern-matched/256234/4 "2020-12-19T17:19:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.