Grok multiple pattern and tag_on_failure for each pattern

Elastic Stack Logstash
1

Hello, I am trying to use multiple grok pattern under single grok, but when any of the pattern matches, it should not add tag_on_failure. Or can I add tag_on_failure for each pattern? Configuration is as below:

grok {
match => { "message" => [ "%{pattern1}", "%{pattern2}" ] tag_on_failure => ["parse-failed"] }

In above case, when logline matches with pattern1 and failed with pattern2 then it add tag_on_failure to it and when logline doesn't match with pattern1 but match with pattern2 then it will not add tag_on_failure.

Please suggest

2

Use the following

  grok {
    break_on_match => true
    tag_on_failure => ["parse-failed"]
    match => [ 'message', '%{PATTERN1}' ]
    match => [ 'message', '%{PATTERN2}' ]
    match => [ 'message', '%{PATTERN3}' ]
}
3

Thanks for the reply and help Bardie. Can you tell me one more thing that why do we need to write "break_on_match => true" when its the default value ? So is that the case with other options as well ?

Ref: https://www.elastic.co/guide/en/logstash/5.3/plugins-filters-grok.html#plugins-filters-grok-break_on_match

1 Like
4

break_on_match => true is used when you have multiple matches and you want to prevent logstash from trying all the match statements on grok

5

Can you tell me one more thing that why do we need to write "break_on_match => true" when its the default value ?

You don't. break_on_match is the default behavior.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.