# Grok Filter Pattern Clarification

**URL:** <https://discuss.elastic.co/t/grok-filter-pattern-clarification/137478>\
**Category:** Logstash\
**Created:** [June 26, 2018, 5:11pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-clarification/137478 "2018-06-26T17:11:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JackTiber](https://avatars.discourse-cdn.com/v4/letter/j/c89c15/32.png) [@JackTiber](https://discuss.elastic.co/u/JackTiber)\
**Post date:** [June 26, 2018, 5:11pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-clarification/137478/1 "2018-06-26T17:11:34Z")

</div>

Hey all,

I am setting up centralized logging for a network with 30 - 40 nodes running a bunch of different services. I have divided things up into namespaces to make logging easier and better for visualizing down the road. One item I was having problems with was using custom regex patterns in the grok filter, along with the standard patterns that logstash provides. So I finally found where separating the block below from the standard pattern matching, worked. Which brings up the question if when using the patterns\_dir directive, if it overwrites the standard patterns and they need to be separated? If that is the case, it would be REALLY helpful to mention it in the documentation, because I would prefer to keep filters for certain streams to one block vs two, or more to be honest.

`filter { grok { patterns_dir => ["/etc/logstash/conf.d/patterns"] match => {"message"=> "%{LOG_LEVEL:logLevel}"} } }`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 26, 2018, 5:29pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-clarification/137478/2 "2018-06-26T17:29:28Z")

</div>

> Which brings up the question if when using the patterns\_dir directive, if it overwrites the standard patterns and they need to be separated?

No, they complement each other.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2018, 5:29pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-clarification/137478/3 "2018-07-24T17:29:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.