# Grok mis-function on logstash 5.0
**URL:** https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763
**Category:** Logstash
**Created:** [September 29, 2016, 5:04am UTC](https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763 "2016-09-29T05:04:40Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)
#### Post date: [September 29, 2016, 5:04am UTC](https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763/1 "2016-09-29T05:04:41Z")
When I tried to grok parse my log like below, logstash doesn't give me error but bunch of **adding patterns** everytime before it parses the data. Is it right?
**My Grok:**
grok{
match =\> { "message" =\> "%{SYSLOGBASE} %{GREEDYDATA:message}" }
overwrite =\> ["message"]
}
**Logstash response (to list a few):**
[2016-09-28T22:00:24,906][INFO][logstash.filters.grok] **Adding pattern** {"S3\_REQUEST\_LINE"=\>"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})"}
[2016-09-28T22:00:24,909][INFO][logstash.filters.grok] **Adding pattern** {"S3\_ACCESS\_LOG"=\>"%{WORD:owner} %{NOTSPACE:bucket} \[%{HTTPDATE:timestamp}\] %{IP:clientip} %{NOTSPACE:requester} %{NOTSPACE:request\_id} %{NOTSPACE:operation} %{NOTSPACE:key} (?:"%{S3\_REQUEST\_LINE}"|-) (?:%{INT:response:int}|-) (?:-|%{NOTSPACE:error\_code}) (?:%{INT:bytes:int}|-) (?:%{INT:object\_size:int}|-) (?:%{INT:request\_time\_ms:int}|-) (?:%{INT:turnaround\_time\_ms:int}|-) (?:%{QS:referrer}|-) (?:"?%{QS:agent}"?|-) (?:-|%{NOTSPACE:version\_id})"}
[2016-09-28T22:00:24,909][INFO][logstash.filters.grok] Adding pattern {"ELB\_URIPATHPARAM"=\>"%{URIPATH:path}(?:%{URIPARAM:params})?"}
[2016-09-28T22:00:24,910][INFO][logstash.filters.grok] Adding pattern {"ELB\_URI"=\>"%{URIPROTO:proto}://(?:%{USER}(?::[^@]\*)?@)?(?:%{URIHOST:urihost})?(?:%{ELB\_URIPATHPARAM})?"}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 29, 2016, 5:34am UTC](https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763/2 "2016-09-29T05:34:56Z")
> When I tried to grok parse my log like below, logstash doesn't give me error
Why would it give you an error?
> but bunch of adding patterns everytime before it parses the data. Is it right?
Yes, this is expected. It's reading the patterns from the pattern files and adding them to its in-memory collection of patterns.
---
### Author:  [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)
#### Post date: [September 29, 2016, 5:06pm UTC](https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763/3 "2016-09-29T17:06:34Z")
But it is doing this " **adding pattern**" everytime i launch logstash. Does it not remember them in cache memory if only within a short time?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 29, 2016, 7:13pm UTC](https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763/4 "2016-09-29T19:13:27Z")
> But it is doing this "adding pattern" everytime i launch logstash.
Yes.
> Does it not remember them in cache memory if only within a short time?
No, there's no grok pattern cache.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/grok-mis-function-on-logstash-5-0/61763/5 "2017-07-06T04:36:23Z")