# GROK filter throws ERROR

**URL:** <https://discuss.elastic.co/t/grok-filter-throws-error/143424>\
**Category:** Logstash\
**Created:** [August 8, 2018, 5:04am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424 "2018-08-08T05:04:19Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [August 9, 2018, 7:40am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424/21 "2018-08-09T07:40:13Z")

</div>

I didn't quite get, can you please explain.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 9, 2018, 7:42am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424/22 "2018-08-09T07:42:10Z")

</div>

In a previous post I linked to the Filebeat documentation's collection of examples for various kinds of multiline logs. Follow the example in the Timestamps section.

---

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [August 9, 2018, 8:07am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424/23 "2018-08-09T08:07:07Z")

</div>

These are the patterns for filebeat.yml file. So in a multifile input configuration for each of the files I have to apply multiple patterns (just thinking wont it override). Also there is no configuration on logstash end. This is my understanding is it correct ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 9, 2018, 8:39am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424/24 "2018-08-09T08:39:15Z")

</div>

> These are the patterns for filebeat.yml file.

Yes.

> So in a multifile input configuration for each of the files I have to apply multiple patterns (just thinking wont it override).

Yes, if you have different log formats you'll likely need different multiline configuration.

> Also there is no configuration on logstash end.

Not for multiline, no.

---

<div class="post-metadata">

**Author:** ![Raghuveer\_SJ](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@Raghuveer\_SJ](https://discuss.elastic.co/u/Raghuveer_SJ)\
**Post date:** [August 9, 2018, 8:47am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424/25 "2018-08-09T08:47:48Z")

</div>

I cant thank you enough. but still "thank you" 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2018, 8:51am UTC](https://discuss.elastic.co/t/grok-filter-throws-error/143424/26 "2018-09-06T08:51:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/grok-filter-throws-error/143424.md?page=1)