# Grok filter for different kinds of log in a single file

**URL:** <https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386>\
**Category:** Logstash\
**Created:** [May 13, 2020, 8:02am UTC](https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386 "2020-05-13T08:02:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![falconpurple](https://avatars.discourse-cdn.com/v4/letter/f/aeb1de/32.png) [@falconpurple](https://discuss.elastic.co/u/falconpurple)\
**Post date:** [May 13, 2020, 8:02am UTC](https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386/1 "2020-05-13T08:02:52Z")

</div>

Hi,

I have written grok filter for 2 different types of log lines in a single file.  
The output is not coming but.

The filter that I have written:

```auto

filter {
    grok {
        match => {
            "message" => "%{TIMESTAMP_ISO8601:logdate}\|%{WORD:service_type} \|%{DATA:url}\|%{DATA:filename}\|%{WORD:request_type}\|%{INT:l_num} \]	Querystring: %{WORD:req_type}&pVersion=%{WORD:pversion}&contRep=%{WORD:rep_type}" 
			
        }
    }
	grok {
        match => {
            
			"message" => "%{TIMESTAMP_ISO8601:logdate}\|%{WORD:service_type} \|%{DATA:url}\|%{DATA:filename}\|%{WORD:request_type}\|%{INT:l_num} \]	Path: /isap/archivelink/%{GREEDYDATA:holding_type}"
        }
    }
	
	date {
				match => ["logdate", "YYYY-MM-dd HH:mm:ss,SSS"]
				target => "logdate"
		}
		
		if "_grokparsefailure" in [tags]{
			drop{ }
		}
		
		
}

```

Here is the part of log file.  
The two lines for which filter is written.

```auto
[2018-06-17 20:41:17,864|INFO |https-kite-100|com.defghu.jjj|service|293]	Querystring: fun&pVersion=0046&contRep=W9&docId=00215A9
[2018-06-17 20:41:50,329|INFO |https-joy-88|com.abcd.efg|service|292]	Path: /iasap/archivelink/fun_game

```

I am not getting output.  
Can anyone please help me what I am doing wrong?

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [May 13, 2020, 10:31am UTC](https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386/2 "2020-05-13T10:31:19Z")

</div>

try using grok debugger in kibana dev tools or [grokdebug.herokuapp.com](http://grokdebug.herokuapp.com) to see whether your grok pattern matches your log

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 13, 2020, 2:24pm UTC](https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386/3 "2020-05-13T14:24:34Z")

</div>

You have two groks that cannot both match the same line, so if one matches the other will always result in a \_grokparsefailure, so you will drop {} every line. You could try

```
grok {
    match => {
        "message" => [
            "%{TIMESTAMP_ISO8601:logdate}\|%{WORD:service_type} \|%{DATA:url}\|%{DATA:filename}\|%{WORD:request_type}\|%{INT:l_num} \]	Querystring: %{WORD:req_type}&pVersion=%{WORD:pversion}&contRep=%{WORD:rep_type}",
            "%{TIMESTAMP_ISO8601:logdate}\|%{WORD:service_type} \|%{DATA:url}\|%{DATA:filename}\|%{WORD:request_type}\|%{INT:l_num} \]	Path: /isap/archivelink/%{GREEDYDATA:holding_type}"
        ]
    }
}
```

---

<div class="post-metadata">

**Author:** ![falconpurple](https://avatars.discourse-cdn.com/v4/letter/f/aeb1de/32.png) [@falconpurple](https://discuss.elastic.co/u/falconpurple)\
**Post date:** [May 20, 2020, 9:21am UTC](https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386/4 "2020-05-20T09:21:02Z")

</div>

Thank you,It worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2020, 9:21am UTC](https://discuss.elastic.co/t/grok-filter-for-different-kinds-of-log-in-a-single-file/232386/5 "2020-06-17T09:21:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.