# Grok Filter with alternative

**URL:** https://discuss.elastic.co/t/grok-filter-with-alternative/38858
**Category:** Logstash
**Created:** [January 11, 2016, 9:53am UTC](https://discuss.elastic.co/t/grok-filter-with-alternative/38858 "2016-01-11T09:53:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![golauty](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@golauty](https://discuss.elastic.co/u/golauty)
#### Post date: [January 11, 2016, 9:53am UTC](https://discuss.elastic.co/t/grok-filter-with-alternative/38858/1 "2016-01-11T09:53:54Z")

</div>

Hi,

i have following GrokFilter extract:

> [%{WORD:result}]\s+[Warnings: %{WORD:WarningCount}]|[%{WORD:result}]\s\*[Warnings: %{WORD:WarningCount}]\s\*[Errors: %{WORD:ErrorCount}]\s\*[Exceptions: %{WORD:ExceptionCount}]

For following Log Message:

> [Error] [Warnings: 7] [Errors: 0] [Exceptions: 1]  
> [OK] [Warnings: 7]

But now logstash does not recongnize the fields ErrorCount and ExceptionCount? Why is that so? What can i do?  
Other data fields are recognized like WarningCount and result ...

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 11, 2016, 11:49am UTC](https://discuss.elastic.co/t/grok-filter-with-alternative/38858/2 "2016-01-11T11:49:40Z")

</div>

I'm assuming you have backslashes before the square brackets, i.e. `\[Warnings: ...\]`? Next time make sure you format your regular expressions as code to avoid having e.g. backslashes stripped.

The problem could be that you don't have any parentheses to limit the effects of `|`. You probably want something like this:

```
\[%{WORD:result}]\s+(\[Warnings: ...\]|...)

```

But instead of listing all alternatives I'd actually prefer this:

```
\[%{WORD:result}]\s+ \[Warnings: ...\]( \[Errors: ...\])?( \[Exceptions: ...\])?
```

---

<div class="post-metadata">

### Author: ![golauty](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@golauty](https://discuss.elastic.co/u/golauty)
#### Post date: [January 12, 2016, 5:50am UTC](https://discuss.elastic.co/t/grok-filter-with-alternative/38858/3 "2016-01-12T05:50:18Z")

</div>

Thank you very much that helped.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/grok-filter-with-alternative/38858/4 "2017-07-06T05:16:05Z")

</div>