# Grok Pattern file iteration

**URL:** <https://discuss.elastic.co/t/grok-pattern-file-iteration/153847>\
**Category:** Logstash\
**Created:** [October 24, 2018, 4:19pm UTC](https://discuss.elastic.co/t/grok-pattern-file-iteration/153847 "2018-10-24T16:19:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![camay123](https://avatars.discourse-cdn.com/v4/letter/c/7cd45c/32.png) [@camay123](https://discuss.elastic.co/u/camay123)\
**Post date:** [October 24, 2018, 4:19pm UTC](https://discuss.elastic.co/t/grok-pattern-file-iteration/153847/1 "2018-10-24T16:19:41Z")

</div>

I got a feasability question,

I am using logstash to parse docs, on a specific field of those docs, I want to match against a set of rules defined in a grok patterns file.

MY file would look like:

RULE1 (regex1)  
RULE2 (regex2)  
RULE3 (regex3)

So, basically,

IF field1 match RULE1 in the grok pattern file, add a new field called newfield with a value of "RULE1"

or if field1 matches RULE 2 add a new field called newfield with a value of "RULE2"

is that even possible ? to iterate over the pattern file and stop on match ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2018, 4:19pm UTC](https://discuss.elastic.co/t/grok-pattern-file-iteration/153847/2 "2018-11-21T16:19:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.