# Grok filtering in logstash for multiple defined patterns **URL:** \ **Category:** Logstash\ **Created:** [March 8, 2017, 9:23am UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788 "2017-03-08T09:23:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [March 8, 2017, 9:23am UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/1 "2017-03-08T09:23:03Z")
I am trying to filter my logs matching few patterns I have in the field "full\_log" e.g: ``` E/vincinity/dholland_view_sql_global/IN/Cluster_Node/SSL-CACHE/Dsal1 F/vincinity/dholland_view_sql_local/IN/Cluster_Node3/SSL-CACHE/Dsal4 R/vincinity/dholland_view_sql_bran/IN/Cluster_Node/Sample/vr1.log ``` Now I want to grep these 3 paths from a bunch of logs: basically the pattern that I want to extract is logs containing "vincinity" "sql" and "IN" so with regex it would be simply _vincinity_sql_IN_ I tried this grok filter: ``` grok { match => { "full_log" => "%{URIPATHPARAM:*vincinity*sql*IN*}" } } ``` Then I get \_grokparsefailure in kibana - I'm brand new to grok, so perhaps I'm not approaching this correctly. Thanks, ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 9, 2017, 6:58pm UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/2 "2017-03-09T18:58:28Z")
You should read an introductory article on regular expressions (which are what grok is based on). To match multiple occurrences of any character, use `.*` not `*`. Secondly, grok patterns are used like this: `%{PATTERN_NAME:field}`, where `field` is the name of the field in which to store the matched text. I don't think you want stuff stored in a field named `*vincinity*sql*IN*`. I don't know what you're trying to do. Do you want to extract particular substrings from the contents of the `full_log` field? Or ignore all events whose `full_log` field don't contain vincinity, sql, and IN? ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [March 10, 2017, 8:17am UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/3 "2017-03-10T08:17:39Z")
Thanks this is really helpful - but I'm now having a grok exception, and I'm actually looking for full\_log messages containing the path .\*vincinity.\*sql._IN._ here's the config: cat ./patterns/vinc.txt `VIN .*vincinity.*sql.*IN.*` logstash grok conf: ``` grok { patterns_dir => "./patterns" match => ["full_log" , "%{VIN:path}"] } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 10, 2017, 8:23am UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/4 "2017-03-10T08:23:05Z")
I'm not sure you should be using the grok filter at all. Unless you explain what you want to accomplish it's very hard to give relevant help. > I'm actually looking for full\_log messages containing the path ... Yes, and then what? What do you want to do with those events? What do you want to do with the other events? ---
**Author:** ![OucemaBellagha](https://avatars.discourse-cdn.com/v4/letter/o/5fc32e/32.png) [@OucemaBellagha](https://discuss.elastic.co/u/OucemaBellagha)\ **Post date:** [March 10, 2017, 9:43am UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/5 "2017-03-10T09:43:38Z")
Okay so I need to tag full\_log fields containing .\*vincinity.\*sql._IN._ so that I can perform a search in Kibana using that tag. This is one example but if it works I'll apply more customized patterns later and have more tags for the full\_log fields. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [March 10, 2017, 12:42pm UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/6 "2017-03-10T12:42:27Z")
Then I suggest something like this: ```nohighlight if [full_log] =~ /vincinity.*sql.*IN/ { mutate { add_tag => ["whatever"] } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 7, 2017, 12:42pm UTC](https://discuss.elastic.co/t/grok-filtering-in-logstash-for-multiple-defined-patterns/77788/7 "2017-04-07T12:42:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.