# Grok Help - specificity?

**URL:** <https://discuss.elastic.co/t/grok-help-specificity/226802>\
**Category:** Logstash\
**Created:** [April 7, 2020, 1:00am UTC](https://discuss.elastic.co/t/grok-help-specificity/226802 "2020-04-07T01:00:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![almathden](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@almathden](https://discuss.elastic.co/u/almathden)\
**Post date:** [April 7, 2020, 1:00am UTC](https://discuss.elastic.co/t/grok-help-specificity/226802/1 "2020-04-07T01:00:28Z")

</div>

Hey Team, trying to match my watchguard logs. Depending on the log entry the format varies pretty wildly so I have a few different matches set up. Problem is matching a new entry I'm working on is...too generic? And so it matches everything.

Generic entry:  
`HA-M300Active (2020-04-07T00:36:11) sessiond[2325]: process status xpath /toSessiond/updateActivity`

Working fine:  
`HA-M300Active (2020-04-06T22:35:53) firewall: msg_id="3000-0151" Allow 1-LAN-P1 6-Internet-P6 udp 10.1.2.2 8.8.8.8 45410 53 duration="30" sent_bytes="59" rcvd_bytes="91" (Allow Out - DNS-00)`

Here's how I am matching it now, and I guess I just need to learn how to be more specific.

`%{IPORHOST:syslog_host} \(%{TIMESTAMP_ISO8601:log_date}\) %{SYSLOGPROG}: %{DATA:content}`

So that matches, and puts the "process status xpath /toSessiond/updateActivity" in the content entry. But the other entry ends up with this as "content":

`msg_id="3000-0151" `

And of course this is all tossed away:  
`Allow 1-LAN-P1 6-Internet-P6 udp 10.1.2.2 8.8.8.8 45410 53 duration="30" sent_bytes="59" rcvd_bytes="91" (Allow Out - DNS-00)`

I tried putting the less specific match last but that doesn't seem to have helped.

Help? 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2020, 1:08am UTC](https://discuss.elastic.co/t/grok-help-specificity/226802/2 "2020-05-05T01:08:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.