# Grok filter question: don't understand %{COMBINEDAPACHELOG}+

**URL:** <https://discuss.elastic.co/t/grok-filter-question-dont-understand-combinedapachelog/136982>\
**Category:** Logstash\
**Created:** [June 22, 2018, 7:26am UTC](https://discuss.elastic.co/t/grok-filter-question-dont-understand-combinedapachelog/136982 "2018-06-22T07:26:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![keli](https://avatars.discourse-cdn.com/v4/letter/k/f6c823/32.png) [@keli](https://discuss.elastic.co/u/keli)\
**Post date:** [June 22, 2018, 7:26am UTC](https://discuss.elastic.co/t/grok-filter-question-dont-understand-combinedapachelog/136982/1 "2018-06-22T07:26:48Z")

</div>

I found a very good grok filter tutorial [here](https://qbox.io/blog/logstash-grok-filter-tutorial-patterns?utm_source=qbox.io&utm_medium=article&utm_campaign=logstash-grok-filter-tutorial-patterns). Every concept is well explained except this apache grok filter configrathton.

```auto
grok {
   match => [
         "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}",
         "message" , "%{COMMONAPACHELOG}+%{GREEDYDATA:extra_fields}"
   ]
   overwrite => ["message"]
}

```

what is the objectif of "+" after "%{}"?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 22, 2018, 3:40pm UTC](https://discuss.elastic.co/t/grok-filter-question-dont-understand-combinedapachelog/136982/2 "2018-06-22T15:40:49Z")

</div>

> [@keli](#):
>
> what is the objectif of "+" after "%{}"?

Truly, you have groked grok! The + is completely useless. The pattern says to match one or more COMBINEDAPACHELOG patterns, followed by other random stuff. But a line from a web server log is going to have exactly one COMBINEDAPACHELOG pattern, possibly followed by extra fields. One line is never going to look like %{COMBINEDAPACHELOG}%{COMBINEDAPACHELOG}%{GREEDYDATA:extra\_fields}.

So it works, since one is matched by "one or more", but it does not add any value, since the "or more" part will never be matched.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2018, 3:41pm UTC](https://discuss.elastic.co/t/grok-filter-question-dont-understand-combinedapachelog/136982/3 "2018-07-20T15:41:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.