# GROK multiple MATCH filters

**URL:** <https://discuss.elastic.co/t/grok-multiple-match-filters/27940>\
**Category:** Logstash\
**Created:** [August 24, 2015, 11:29am UTC](https://discuss.elastic.co/t/grok-multiple-match-filters/27940 "2015-08-24T11:29:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunny\_Advani](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@Sunny\_Advani](https://discuss.elastic.co/u/Sunny_Advani)\
**Post date:** [August 24, 2015, 11:29am UTC](https://discuss.elastic.co/t/grok-multiple-match-filters/27940/1 "2015-08-24T11:29:27Z")

</div>

Apologies if this has been asked repetitively, however I have a hard time understanding multiple MATCH filters using GROK.

Here is my config:

filter {  
grok {  
break\_on\_match =\> false  
keep\_empty\_captures =\> true  
match =\> { "message" =\> ["%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host} %{DATA:datagridobject} [event-type=%{DATA:event-type}][guid=%{DATA:guid}][user-id=%{DATA:user-id}][profile=%{DATA:profile}][session-id=%{DATA:session-id}][duration=%{DATA:duration}][result-id=%{DATA:result-id}][result-count=%{DATA:result-count}]",  
"%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host} %{DATA:datagridobject} [event-type=%{DATA:event-type}][guid=%{DATA:guid}][user-id=%{DATA:user-id}][profile=%{DATA:profile}][session-id=%{DATA:session-id}][duration=%{DATA:duration}][result-id=%{DATA:result-id}][result-count=%{DATA:result-count}][text=%{DATA:text}]"  
]}  
}  
}

I am trying to index :

Mar 23 09:49:32 WIN-12345 Web1 [event-type=XYZ][guid=abc12345][user-id=abcdefg][profile=profileName][session-id=12345][duration=01][result-id=abc123][result-count=0][text=abc]

And it never gets to 2nd MATCH and never extract "text"

Am I missing something?

Regards,  
Sunny

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2015, 11:50am UTC](https://discuss.elastic.co/t/grok-multiple-match-filters/27940/2 "2015-08-24T11:50:01Z")

</div>

Square brackets are metacharacters that need to be escaped. That's most likely your immediate problem. Also, I'd _strongly_ advise against more than one DATA or GREEDYDATA in a single expression. You have little control over how they match.

I suggest you use the [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) instead. Note that your fields can be parsed as `key=value` pairs separated by `][` with a `[` prefix and a `]` suffix. In other words, extract everything between the first and final bracket into a field and use the kv filter on the result (untested):

```
grok {
  match => [
    "message",
    "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host} %{NOTSPACE:datagridobject} \[%{GREEDYDATA:keyvalues}\]"
  ]
}
kv {
  source => "keyvalues"
  field_split => "\]\["
  remove_field => ["keyvalues"]
}

```

---

<div class="post-metadata">

**Author:** ![Sunny\_Advani](https://avatars.discourse-cdn.com/v4/letter/s/ecc23a/32.png) [@Sunny\_Advani](https://discuss.elastic.co/u/Sunny_Advani)\
**Post date:** [August 24, 2015, 1:33pm UTC](https://discuss.elastic.co/t/grok-multiple-match-filters/27940/3 "2015-08-24T13:33:39Z")

</div>

That is absolutely brilliant.!!

Thanks so much, now I don't have to create so many MATCH filters.

Cheers,  
Sunny

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/grok-multiple-match-filters/27940/5 "2017-07-06T05:07:40Z")

</div>